f 



IN THE UNITED STATES ARMY 
FIRST JUDICIAL CIRCUIT 



UNITED STATES 
v. 

MANNING , Bradley E., PFC 
U.S. Army, 

Headquarters and Headquarters Company, U.S. 
Army Garrison, Joint Base Myer-Henderson Hall, 
FortMyer, VA 22211 



) 

) DEFENSE MOTION FOR 

) JUDICIAL NOTICE OF 

) H.R. 553 AND CONGRESSIONAL 

) HEARINGS DISCUSSING 

) CLASSIFICATION 

) 

) DATED: 16 November 2012 
) 



RELIEF SOUGHT 

1 . PFC Bradley E. Manning, by and through counsel, moves this court, pursuant to Military 
Rules of Evidence (M.R.E.) 201, 201A, and 803(8) to take judicial notice of H.R. 553, the 
"Reducing Over-Classification Act," and transcripts of House Committee meetings on the 
Espionage Act (16 December 2010) and Over-Classification (22 March, 26 April, and 28 June, 
2007). 



BURDEN OF PERSUASION AND BURDEN OF PROOF 

2. As the moving party, the Defense has the burden of persuasion. R.C.M. 905(c)(2). The 
burden of proof is by a preponderance of the evidence. R.C.M. 905(c)(1). 

FACTS 

3. PFC Manning is charged with five specifications of violating a lawful general regulation, one 
specification of aiding the enemy, one specification of disorders and neglects to the prejudice of 
good order and discipline and service discrediting, eight specifications of communicating 
classified information, five specifications of stealing or knowingly converting Government 
property, and two specifications of knowingly exceeding authorized access to a Government 
computer, in violation of Articles 92, 104, and 134, Uniform Code of Military Justice (UCMJ) 
10 U.S.C. §§ 892, 904, 934 (2010). 

4. The original charges were preferred on 5 July 2010. Those charges were dismissed by the 
convening authority on 18 March 201 1. The current charges were preferred on 1 March 201 1. 
On 1 6 December through 22 December 201 1 , these charges were investigated by an Article 32 
Investigating Officer. The charges were referred to a general court-martial on 3 February 2012. 

5. On 7 October 2010 President Barack Obama signed H.R. 553, also known as the "Reducing 
Over-Classification Act." See Attachment A. 



APPELLATE EXHIBIT ^0 

PAGE REFERENCED: 

PAGE OF PAGES 



6. The law, which requires "the Secretary of Homeland Security to develop a strategy to prevent 
the over-classification of homeland security and other information/ 5 included a number of 
findings. See Attachment B. The law's findings include: 

a. The National Commission on Terrorist Attacks Upon the United States (commonly 
known as the c 9/l 1 Commission') concluded that security requirements nurture over- 
classification and excessive compartmentation of information among agencies. Id. 

b. The 9/1 1 Commission and others have observed that the over-classification of 
information interferes with accurate, actionable, and timely information sharing, increases 
the cost of information security, and needlessly limits stakeholder and public access to 
information. Id. 

c. Over-classification of information causes considerable confusion regarding what 
information may be shared with whom, and negatively affects the dissemination of 
information within the Federal Government and with State, local, and tribal entities, and 
with the private sector. Id. 

7. On 1 6 December 20 1 0, Thomas Blanton, Director of the National Security Archive at 
George Washington University testified before the House's Committee on the Judiciary during a 
hearing on the Espionage Act and the constitutional implications of WikiLeaks. See Attachment 
C. Mr. Blanton testified that 50-90% of what is classified is either over-classified or should npt 
be classified at all. Id. He further testified that over-reaction to leaks is well-documented 
throughout American history. Id. 

8. Over the course of three days in 2007 (22 March, 26 April, and 28 June) the Subcommittee on 
Intelligence, Information Sharing, and Terrorism Risk Assessment of the House Committee on 
Homeland Security heard testimony on Over-Classification and Pseudo-Classification. See 
Attachment D. The hearings include testimony from a number of public officials and experts 
discussing the negative impact of over-classification and the problems presented by the practice. 
Id. 



WITNESSES/EVIDENCE 

9. The Defense does not request any witnesses be produced for this motion. The Defense 
respectfully requests this Court to consider the referenced attachments to this motion in support 
of its request. 

LEGAL AUTHORITY AND ARGUMENT 

10. In the interest of judicial economy, M.R.E. 201(a) and 201 A relieve a proponent from 
formally proving certain facts that reasonable persons would not dispute. First, the military 
judge may take judicial notice of adjudicative facts "capable of accurate and ready determination 
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by resort to sources whose accuracy cannot reasonably be questioned." M.R.E. 201(b)(2). This 
category of adjudicative facts includes government records, business records, information in 
almanacs, scientific facts, and well documented reports. Id See also, United States v. Spatm, 24 
M.J. 508 (A.F.C.M.R. 1987). The key requirement for judicial notice under this category is that 
the source relied upon must be reliable. Pursuant to M.R.E. 201 A, a military judge, "may take 
judicial notice of domestic law." 

1 1 . Under M.R.E. 201 (d), a military judge must take judicial notice if the proponent presents the 
necessary supporting information. In making the determination whether a fact is capable of 
being judicially noticed, the military judge is not bound by the rules of evidence. 1 STEPHEN A. 
SALTZBURG, LEE D. SCHINASI, AND DAVID A.SCHLUETER, MILITARY RULES OF 
EVIDENCE MANUAL 201 .02[3] (2003) Additionally, the information relied upon by the 
party requesting judicial notice need not be otherwise admissible. Id The determination of 
whether a fact is capable of being judicially noticed is a preliminary question for the military 
judge. See M.R.E. 104(a). 

12. H.R. 553 is appropriate for judicial notice. As a bill that was signed into law by the 
President of the United States, it unquestionably qualifies as domestic law as contemplated by 
M.R.E. 201 A. Because the "Reducting Over-classification Act" is a domestic law it is 
appropriate for judicial notice. M.R.E. 201A. Likewise, the law is relevant on both the merits 
and sentencing. Congress found that overclassification results in confusion about what 
information can be shared with whom. See Attachment B. This fact would rebut any argument 
that PFC Manning had a reason to know that information could be used to the injury of the 
United States or to the advantage of a foreign nation simply because a document is classified. 
See Amicus Curiae Brief of Pepperdine University School of Law, United States v. Diaz, 2010 
WL 519394. Because H.R. 553 makes an element of several Specifications less likely it is 

i^e levant on the merits. 

13. The law would also be relevant during any pre-sentencing phase of PFC Manning's trial. 
R.C.M. 1001(c) permits an accused to present matters in extenuation and mitigation during such 
a phase. These matters would tend to explain the circumstances surrounding the commission of 
an offense or tend to lessen the punishment. Id. The acknowledgment by Congress that PFC 
Manning was operating in a broken system that limited public access to information would serve 
to explain the circumstances surrounding the alleged misconduct. Acknowledgment by Congress 
that at least some of the charged documents in this case were not properly classified may tend to 
lower PFC Manning's punishment. As such, H.R. 553 is relevant and should be judicially 
noticed. 

14. Mr. Thomas Blanton's testimony before the House Judiciary Committee is proper for 
judicial notice because it is a relevant statement for which there is a hearsay exception. This 
Court has acknowledged that a "Congressional record could be admissible under MRE 803(8)(A) 
if relevant." See Appellate Exhibit 356 at 12. Transcripts of Congressional hearings document 
the activities of Congress and are, thus, contemplated by M.R.E. 803(8)(A). Because Mr. 
Blanton testified before Congress and are included in the transcript of the Congressional hearing, 
his statements are properly admitted under M.R.E. 803(8)(A). 
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15. Hearsay concerns alleviated, Mr. Blanton's testimony is relevant at both the merits and any 
pre-sentencing phase. Mr. Blanton testified in part: 

Mr. Chairman, it is a great honor for me, and Judge Gohmert and also to be in the 
middle of this extraordinary high-level tutorial in the Espionage Act and the 
Constitution. I feel like a grad student again; and it is a joy, actually. I also wanted 
to thank you, Mr. Chairman, for resurrecting my graveyard quote, that we have 
low fences around vast prairies of government secrets where we really need tall 
fences around small graveyards of the real secrets; and that is a core point I want 
to come back to today. I really have three points. One of them is the government 
always overreacts to leaks, always; and all you have to do is say the phrase 
"Watergate plumbers" and you know what I am talking about. 

Back then, they were discussing firebombing the Brookings Institution on the 
chance there might still be a copy of the Pentagon papers in there. Today, you are 
having debates on FOX news: Let's do some targeted assassination attempts on 
Julian Assange. Well, I have to say G. Gordon Liddy would be right at home, and 
both is absurd. And the overreaction the government typically does is not to kill 
anybody or to firebomb something but to go right to the second major point I 
want to make today. They are going to classify more information. 

What I am worried about most is the backlash. I mean, in my prepared statement, 
I have got multiple examples of all the estimates, and they range from 50 percent 
to 90 percent, of what the problem of overclassification really amounts to. 
Governor Tom Kean, head of the 9/1 1 Commission, after looking at all of the al 
Qaeda intelligence that we gathered before 9/11, said, you know, 75 percent of 
what I saw that was classified should not have been. And the Commission said we 
not only needed to do information sharing between the agencies, we had to do 
information sharing with the American people, because that is the only way we 
can really protect ourselves. What a great lesson that is. 

The system is so overwhelmed with the secrets that we can no longer really 
protect the real ones and we can't let out the ones that would actually keep us all 
safer. 

And I think it is a mistake to try to see this as a balancing test. It is not a balance 
between openness and security. The findings of the 9/11 Commission were that 
more openness would have made us more secure. That is what you do an in open 
society to keep yourself safe. You are not safer in the dark. You don't hide your 
vulnerabilities. You expose them and you fix them. That is how we proceed in 
America. 

The third point I just want to make about where we are today. We are in the 
middle of a syndrome that one senior government official I really respect holds all 
the clearances, does the audits, pushes back against excessive secrecy, called it 
Wikimania. We are in the middle of Wikimania, and it is going to lead to so much 
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more heat than light. Targeted assassination is only the most extreme case, but 
look at all the other proposals we have got on the table and the front burners to try 
to push back, to punish WikiLeaks, to push back against speech. See Attachment 
C 

He went on to testify: 

I have to tell you, I wish every terrorist group in the world would write the U.S. 
ambassador in their local town, you know, days or a week before they are about to 
launch something, and ask the ambassador, hey, would you help us, you know, 
make sure nobody innocent gets hurt? Would you really work with us? We would 
be glad to talk to you. 

And I understand why the ambassadors didn't believe them. Because WikiLeaks 
said, oh, and, by the way, we will keep anything you say to us confidential. It is 
hard to square with the previous statements of WikiLeaks. 

But I wish every terrorist group would get into partnership with Le Monde and El 
Pais and the Guardian and the New York Times to assess what the damage might 
be, to redact their own documents, to put regulators on the bombs they drop. That 
would be a good thing. WikiLeaks is not terrorists. Id 

Like H.R. 553, evidence of overclassification makes it less likely that a document's classification 
marking put PFC Manning on notice that its disclosure could result in injury to the United State 
or benefit a foreign nation. M.R.E. 401 . As such, Mr. Blanton's testimony is relevant on the 
merits. Likewise, it is relevant during any pre-sentencing phase because it establishes the 
circumstances surrounding PFC Manning's alleged misconduct. Evidence of consistent 
historical over-reaction to alleged unauthorized disclosures by the Government suggest yet 
another overreaction by the Government in PFC Manning's case. Such evidence would tend to 
mitigate PFC Manning's alleged misconduct and is, thus, relevant. R.C.M. 1001(c). 

1 6. The proffered House of Representatives hearings from 2007 are also admissible and 
relevant. This Court has acknowledged that a "Congressional record could be admissible under 
MRE 803(8)(A) if relevant." See Appellate Exhibit 356 at 12. Transcripts of Congressional 
hearings document the activities of Congress and are, thus, contemplated by M.R.E. 803(8)(A). 
Because the proffered transcript documents the activities of Congress it falls under the hearsay 
exception offered by M.R.E. 803(8)(A). 

1 7. The proffered transcript is relevant on both the merits and during any necessary pre- 
sentencing phase. The transcript laid the foundation for the sentiment that Mr. Blanton and H.R. 
553 would later echo: a shocking percentage of documents are wrongly classified. Included in 
the transcript is testimony from J. William Leonard, Director of Information Security Oversight 
Office at the National Archives and Records Administration. Mr. Leonard testified that a review 
by his office discovered that classification was clearly done correctly only 64% of the time. See 
Attachment D at 6. Thus, classification is wrong more than 1/3 of the time. Again, such 
evidence rebuts any argument that PFC Manning knew or should have known that a document 
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could cause injury to the United States or benefit a foreign nation based solely on the document's 
classification. Because the transcript makes an element of several charged Specifications less 
likely, it is relevant. M.R.E. 401. Likewise, the transcript is filled with evidence that establishes 
the circumstances under which PFC Manning was operating at the time of the alleged 
misconduct. Evidence that the classification system was broken and its condition had negative 
consequences for the nation would tend to shift some of the culpability from PFC Manning on to 
the system itself. Because such evidence could tend to lower PFC Manning's punishment it is 
relevant during any necessary pre-sentencing phase. 



1 8. Based on the above, the Defense requests that the Court to take judicial notice of the 
requested adjudicate facts and law. 



CONCLUSION 



JOSHUA J. TOOMAN 
CPT, JA 
Defense Counsel 
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Log In 



HOME BROWSE TRACK ABOUT USi 



congress bills H.R, 553 (lllTH) 



H.R. 553 (mth): Reducing Over-Classification Act 

mth Congress, 2009-2010 

To require the Secretary of Homeland Security to develop 
a strategy to prevent the over-classification of homeland 
security and other information and to promote the 
sharing of unclassified homeland security and other 
information, and for other purposes. 

Introduced: Jan 15, 2009 

Sponsor: Rep. Jane Harman [D CA36] 

Status; Signed by the President 



Bill titles and the summary above are written by the sponsor. 
H.R. stands for House of Representatives bill. 



BILL OVERVIEW 



STATUS: 



Introduced 

Passed House 

Passed Senate with 
Changes 

Passed Senate 



Jan 15, 
2009 
Feb 03, 
2009 
Sep 27, 
2010 
Sep 28, 
2010 



RELATED 
BILLS: 

SUBJECT 
AREAS: 



Search for similar bills. 



Use these subject area: 
explore related legislate 

Government Operatlo 
Politics 
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Signed by the 
President 



Oct 07, 
2010 



This bill was enacted after being 
signed by the President on October 
7, 2010. 



TEXT: 



Read Bill Text 



COSPONSORS: none 



COMMITTEES: 



PRIMARY 
SOURCE 



CITATION 



House Committee on Homeland 
Security 

Senate Committee on Homeland 
Security and Governmental 
Affairs 

The committee chair determines 
whether a bill will move past the 
committee stage. 
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one day after events occur and 
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This page can be cited in one of 
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APA, MLA, Wikipedia Template, 
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OFFICIAL SUMMARY 

This summaty was written by the Congressiom 
Setvice, a nonpartisan arm of the Library of Cc 
GovTrack did not write and has no control ovei 
summaries. 

1 0/7/201 0— Public Law. (This measure has not 
amended since it was passed by the Senate oi 
27, 2010. The summary of that version is repe; 
Reducing Over-Classification Act - 

Section 4 - 

Amends the Homeland Security Act of 2002 (H 
the Secretary of Homeland Security (DHS) to c 
Classified Information Advisory Officer to develop and disseminate educational materials and to develop 
administer training programs to assist state, local, and tribal governments (including law enforcement ag 
private sector entities; 

(1) in developing plans and policies to respond to requests related to classified information without comn 
information to individuals who lack appropriate security clearances: 

(2) regarding the appropriate procedures for challenging classification designations of information receiv 
personnel of such entities; and 

(3) on the means by which such personnel may apply for security clearances. 

Directs such Officer to inform the Under Secretary for Intelligence and Analysis on policies and procedur 
facilitate the sharing of classified information with such personnel. 

Section 5 - 

Amends the National Security Act of 1947 to require the Director of National intelligence to establish: 

(1) guidance to standardize formats for classified and unclassified intelligence products for purposes of f 
sharing of such products; and 

(2) policies and procedures requiring the increased use, including portion markings, of the classification ( 
information within one intelligence product. 

Amends HSA to: 

(1) include among the responsibilities of the Secretary relating to intelligence and analysis and infrastruc 
to integrate relevant information, analysis, and vulnerability assessments in order to prepare finished inU 
information products in both classified and unclassified formats whenever reasonably expected to be of I 
state, local, or tribal government or a private sector entity; and 

(2) require the state, local, and tribal homeland security and law enforcement officers and intelligence an 
assigned by the Interagency Threat Assessment and Coordination Group (ITACG) Detail to work in the f 
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Counterterrorism Center to make recommendations to the Secretary for the further dissemination of Intel 
products that could likely inform or improve the security of such a government or entity. 

Requires the Secretary, in coordination with the Director of the National Conterterrorism Center and the 
Advisory Council, to: 

(1) compile an annual assessment of ITACG Detail's performance, including summaries of customer fee< 
preparing, disseminating, and requesting the dissemination of intelligence products intended for state, lo 
government and private sector entities; 

(2) provide such assessment to the program manager for the information sharing environment for use in 
report on ITACG progress. 

Requires such report to include an assessment of whether the ITACG detailees have appropriate access 
information as required. 

Section 6 - 

Permits the President or the head of an agency with an officer or employee who is authorized to make oi 
derivative classification decisions, In making certain cash incentive awards, to consider such officer's on 
consistent and proper classification of information. 

Requires the inspector general of each such agency, in consultation with the Information Security Oversi 
carry out at least two evaluations of that agency or components thereof to: 

(1) assess whether applicable classification policies, procedures, rules, and regulations have been adop* 
and effectively administered; and 

(2) identify policies, procedures, rules, regulations, or management practices that may be contributing to 
misclassification of material. 

Requires each first evaluation to be completed by September 30, 2013, and each second evaluation to t 
by September 30, 2016. 

Requires each inspector general to: 

(1) submit a report on each such evaluation to specified congressional committees, the agency head, an 
of the Information Security Oversight Office; and 

(2) coordinate with other inspectors general and with the Information Security Oversight Office to ensure 
evaluations follow a consistent methodology that allows for cross-agency comparisons. 

Section 7 - 

Directs the head of each executive agency, in accordance with Executive Order 13526, to require: 

(1) annual training for each employee who has original classification authority; and 

(2) training at least every two years for employees who perform derivative classification or are responsib 
dissemination, preparation, production, receipt, publication, or otherwise communication of classified infc 

Requires such training to: 
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(1) educate the employee regarding the guidance established under the National Security Act of 1947 re 
formatting of finished intelligence products, the proper use of classification markings, and incentives and 
related to the proper classification of intelligence information; and 

(2) serve as a prerequisite for obtaining and maintaining original classification authority or derivatively cU 
information. 

Directs each agency head to ensure that the training is conducted efficiently and in conjunction with any 
security, intelligence, or other training programs to reduce the associated costs and administrative burde 
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ATTACHMENT B 



One hundred 35leuenth Congress 

of the 

United States of America 

AT THE SECOND SESSION 

Begun and held at the City of Washington on Tuesday, 
the fifth day of January t Uco thousand and ten 



2n 2tct 

To rc<iu>ro th« Sec<oUry of Homeland Security to develop a strategy to prevent 
the over-classification of homeland security and other information and to proraoto 
the sharing of unclassified homoland security and other information, and for 
other purposes. 

Be it enacted by (he Senate and House of Representatives of 
the United States of America in Congress assembled, 

SECTION J. SHORT TITLE. 

This Act may be cited as the r Reducing Over-Classification 
Act". 

SEC. 2. FINDINGS. 

Congress finds the following: 

(1) The National Commission on Terrorist* Attacks Upon 
the United States (commonly known as the v 9/ll Commission") 
concluded that security requirements nurture over-classification 
and excessive compartmentation of information among agencies. 

(2) The 9/H Commission and others have observed that 
the over-classification of information interferes with accurate, 
actionable, and timely information sharing, increases the cost 
of information security, and needlessly limits stakeholder and 
public access to information. 

(3) Over-classification of information causes considerable 
confusion regarding what information may be shared with 
whom, and negatively affects the dissemination of information 
within the Federal Government and with State, local, and 
tiibal entities, and with tho private sector. 

(4) Over classification of information is antithetical to the 
creation and operation of the information sharing environment 
established under section 1016 of the Intelligence Reform and 
Terrorism Prevention Act of 2004 (6 U.S.C. 486). 

(6) Federal departments or agencies authori2ed to make 
original classification decisions or that perform derivative 
classification of information are responsible for developing, 
implementing, and administering policies, procedures, and pro- 
grams that promote compliance with applicable laws, executive 
orders, and other authorities pertaining to the proper use of 
classification markings and the policies of the National Archives 
and Records Administration, 

SEC. 3. DEFINITIONS. 
In this Act: 
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(1) Derivative classification and original classify 
TION.— » The terms "derivative classification" and "original classi- 
fication" have the meanings given those terms in Executive 
Order No. 13526. 

(2) Executive agency.— The term "Executive agency" has 
the meaning given that term in section 105 of title 5, United 
States Code. 

<3> Executive order no. msw. The term "Executive 
Order No. 13526" means Executive Order No. 13626 (76 Fed. 
Reg. 707: relating to classified national security information) 
or any subsequent corresponding executive order. 

SBC. 4. CLASSIFIED INFORMATION ADVISORY OFFICER. 

(a) In GENKRAL,^Subtitle A of title II of the Homeland Security 
Act of 2002 (6 U.S.C 121 et seq.) is amended by adding at the 
end the following: 

"SEC. 210F. CLASSIFIED INFORMATION ADVISORY OFFICER. 

"(a) Requirement To Estabj .ish. — 'The Secretary shall identify 
and designate within the Department a Classified Information 
Advisory Officer, as described in this section. 

"(b) Responsibilities. The responsibilities of the Classified 
Information Advisory Officer shall be as follows: 

"(1) To develop and disseminate educational materials and 
to develop and administer training programs to assist State, 
local, and tribal governments (including State, local, and tribal 
law enforcement agencies) and private sector entities— 

"(A) in developing plans and policies to respond to 
requests related U» classified information without commu- 
nicating such information to individuals who lack appro- 
priate security clearances; 

"(B) regarding the appropriate procedures for chal- 
lenging classification designations of information received 
by personnel of such entities; and 

"(C) on the means by which such personnel may apply 
for security clearances. 

"(2) To inform the Under Secretary for Intelligence and 
Analysis on policies and procedures that could facilitato the 
sharing of classified information with such personnol, as appro- 
priate. 

"(c) Initial Dbcionation.— Not later than 90 days after the 
date of the enactment of the Reducing Over-Classification Act, 
the Secretary shall 

"(1) designate the initial Classified Information Advisory 

Officer; and 

*\2) submit to tho Committee on Homeland Security and 
Governmental Affairs of the Senate and the Committee on 
Homeland Security of tho House of Representatives a written 
notification of the designation 

(b) Clerical Amendment.— The table of contents in section 
1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 et sett) 
is amended by inserting after the Horn relating to section 210E 
the following: 

*Sc^ 21QP. ClswiticJ Information Advtocy Officer.". 



H. R.553— 3 
$E0. 5. INTELLIGENCE INFORMATION SHARING, 

(a) Development of Guidance for Intelligence Prod- 
ucts.— Paragraph (1) of section 102A(g) of the National Security 
Act of 1947 (50 U,S,C. 403-l(g)) is amended— 

(1) in subparagraph <E). by striking "and" at the end: 

(2) in subparagraph <F), ny striking the period at the end 
and inserting a semicolon and "and"; and 

(3) by adding at the end tho following; 

"(G) in accordance with Executive Order No. 13526 
(76 Fed. Reg. 707; relating to classified national security 
information) (or any subsequent corresponding executive 
order), and part 2001 of title 32, Gode of Federal Regula- 
tions (or any subsequent corresponding regulation), estab- 
lish— 

M (i) guidance to standardize, in appropriate cases, 
the formats for classified and unclassified intelligence 
products created by elements of the intelligence 
community for purposes of promoting the sharing of 
intelligence products; and 

**<ii) policie and procedures requiring the 
increased use, in appropriate cases, and including por- 
tion markings, OF the classification of portions of 
information within one intelligence product.". 

(b) Creation op Unclassified Intelligence pRODucrs as 
Appropriate for State, local, Tribal, and Private Sector 
Stakeholders.— 

(1) Responsibilities of secretary relating to intel- 
ligence AND ANALYSIS AND INFRASrRUCrURE protection.— 
Paragraph (3) of section 201(d) of the Homeland Security Act 
of 2002 (6 U.S.C. 121(d)) is amended to read as follows: 

,( (3) To integrate relevant information, analysis, and vulner- 
ability assessments (regardless of whether such information, 
analysis or assessments are provided by or produced by t 
Department) in order to — 

*'(A) identify priorities for protective and support meas- 
ures regarding terrorist and other threats to homeland 
security by the Department, other agencies of the Federal 
Government, State, and local government, agencies and 
authorities, the private sector, and other entities; and 

'KB) prepare finished Intelligence and information prod- 
ucts in both classified and unclassified formats, as appro* 
priate, whenever reasonably expected to be of benefit to 
a State, local, or tribal government (including a Stnte, 
local, or tribal law enforcement agency) or a private sector 
entity.". 

(2) ITACG detail.— Section 2lOD(d) of the Homeland Secu- 
rity Act of 2002 (6 U.S.G. 124k<d)) is amended— 

(A) in paragraph (6>— 

(i) in subparagraph (D), by striking "and" at the 

end; 

(ii) by redesignating subparagraph (E) as subpara- 
graph (F); and 

(iii) by inserting after subparagraph (D) the fol- 
lowing: 

,f (E) make recommendations, as appropriate, to the 
Secretary or the Secretary's designee, for the further 
dissemination of intelligence products that could likely 
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inform or improve the security of a State, local, or tribal 
government, (including a State, local, or tribal law enforce- 
ment agency) or a private sector entity; and"; 

(B) in paragraph (6XC), by striking "and" at the end; 

(C) in paragraph (7), by striking the period at the 
end and inserting a semicolon and "and"; and 

(D) by adding at the end the following: 

"(8) compile an annual assessment of the ITACG Detail's 
performance, including summaries of customer feedback, in 
preparing, disseminating, and requesting the dissemination of 
intelligence products intended for Stato, local and tribal govern 
ment (including State, local, and tribal law enforcement agen 
cies) and privaU sector entities; and 

"(9) provide the assessment developed pursuant to para 
graph (8) to the program manager for use in the annual reports 
required by subsection (c)(2).". 

(c) Intkraoency Threat Assessment and Coordination 
Group Annual Report Modification..— Subsection (c> of section 
210D of the Homeland Security Act of 2002 (S U.S.C. 124k) is 
amended — 

(1) in the matter preceding paragraph (1), by striking M , 
in consultation with the Information Sharing Council,"; 

(2) in paragraph (1), by striking "and" at the end; 

(3) in # paragraph (2), by striking the period at the end 
and inserting a somicolon and "and"; and 

(4) by adding at the end the following: 

*K3) in each report required by paragraph (2) submitted 
after the date of the enact of the Reducing Over-Classifica- 
tion Act, include on assessment of whether tho detaileas under 
subsection (dX6) have appropriate access to all relevant 
information, as required by subsection (g)(2)(G).". 

SEC. 6. PROMOTION OF ACCURATE CI OSSIFICATION OF INFORMATION. 

(a) Incentives for Accurate Classifications. In making 
cash awards under chapter 45 of titie 5, United States Code, the 
President or the head of an Executive agency with an officer or 
employee who is authorized to make original classification decisions 
or derivative classification decisions may consider such officer's 
or employee's consistent and proper classification of information. 

(1>5 Inspector General Evaluations. 

(1) Requirement FOR EVALUATIONS. — Not later than Sep- 
tember 30, 2016, the inspector general of each department 
or agency of tho United States with an officer or employee 
who is authorized to make original classifications, in consulta.- 
tion with the Information Security Oversight Office, shall carry 
out no less than two evaluations of that department or agency 
or a component of the department or agencjv- 

(A) to assess whether applicable classification policies, 
procedures, rules, and regulations have been adopted, fol- 
lowed, and effectively administered within such depart- 
ment, agency, or component; and 

(B) to identify poltcies, procedures, rules, regulations, 
or management practices that may be contributing to per- 
sistent rnisclassification of material within such depart- 
ment, agency or component. 

(2) Deadlines for evaluations.— 
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(A) Initial evaluations. Each first evaluation 
required by paragraph (1) shall be completed no later than 
September 30, 2013, 

(B) Second evaluations.— Bach second evaluation 
required by paragraph (1) shall review progress made 
pursuant to tne results of the first evaluation and shall 
bo completed no later than September 30, 2016. 

(3) REPORTS.— 

(A) Requirement. Each inspector general who is 
required to carry out an evaluation under paragraph (1) 
shall submit to he appropriate entities a report on each 
such evaluation. 

(B) Content.— Each report submitted under subpara- 
graph (A) shall include a description of 

(i) the policies, procedures, rules, regulations, or 
management practices, if any, identified by tho 
inspector general under paragraph (l)(B); and 

(ii) the recommondations ? if any, of the inspector 

feneral to address any such identified policies, proc- 
ures, rules, regulations, or management practices. 

(C) Coordination. The inspectors general who aro 
required to carry out evaluations under paragraph (1) shall 
coordinate with each other and with the Information Secu- 
rity Oversight OJfice to ensure that evaluations follow a 
consistent methodology, as appropriate, that allows for 
cross-agency comparisons. 

(4) Appropriate entities defined.— In this subsection, the 
term ^appropriate entities" means— 

\A) the Commit ee on Homeland Security and Govern- 
mental Affairs and the Select Committee on Intelligence 
of the Senate; 

<B) the Committee on Homeland Security, the Com- 
mittee on Oversight and Government Reform, and the 
Permanent Select Committee on Intelligence of the House 
of Representatives; 

(C) any other committee of Congress with jurisdiction 
over a department or agency referred to in paragraph (1); 

(D) the head of a department or agency reforred to 
in paragraph (1); and 

(E) the Director of the Information Security Oversight 
Office. 

SECY. CI.ASSIFICATION TRAINING PROGRAM. 

(a) In General. — The head of each Executive agency, in accord- 
ance with Executive Order 13526, shall require annual training 
for each employee who has original classifica ion authority. For 
employees wno porform derivative classific or are responsible 
for analysis, dissomination, preparation, production, receipt, 
publication, or otherwise communication of classified information, 
training shall be provided at least every two years. Such training 
shall 

(1) educate the employee, as appropriate, regarding — 

(A) the guidance established under subparagraph (G) 
of section 102A(g)(l) of the National Security Act of 1947 
(50 U.S.C; 403-KgXl)), as added by section 5(a)(3), 
regarding the formatting of finished intelligence products; 
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(B) the proper use of classification markings, including 
portion markings that indicate the classification of portions 
of information; and 

(C) any incentives and penalties related to the proper 
classification of intelligence information; and 

(2) ensure such training is a prerequisite, once completed 
successfully, as evidenced by an appropriate certificate or other 
record, for — 

(A) obtaining original classification authority or deriva 
tively classifying information* and 
IB) maintaining such authority, 
(b) Relationship to Other Programs.— The head of each 
Executive agoncy shaU ensure that the training required by sub- 
section (a) Is conducted efficiently and in conjunction with any 
other required security, intelligence, or other training programs 
to reduce the costs and administrative burdens associated with 
carrying out the training required by subsection (a). 



Speaker of the House of Representatives. 



Vice President of the United States and 

President of the Senate. 
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search of the truth and informing us all." He is also the founding 
editorial board member of freedominfo.org, a network of inter- 
national freedom of information advocates. 

I read your prepared statement with great enthusiasm, and we 
are happy to have you here today. 

TESTIMONY OF THOMAS S. BLANTON, DIRECTOR, NATIONAL 
SECURITY ARCHIVE, GEORGE WASHINGTON UNIVERSITY 

Mr. BLANTON, Mr. Chairman, it is a great honor for me, and 
Judge Gohmert and also to be in the middle of this extraordinary 
high-level tutorial in the Espionage Act and the Constitution. I feel 
like a grad student again; and it is a joy, actually. 

I also wanted to thank you, Mr. Chairman, for resurrecting my 
graveyard quote, that we have low fences around vast prairies of 
government secrets where we really need tall fences around small 
graveyards of the real secrets; and that is a core point I want to 
come oack to today. 

I really have three points. One of them is the government always 
overreacts to leaks, always; and all you have to do is say tne 
phrase "Watergate plumbers" and you know what I am talking 
about. 

Back then, they wore discussing firebombing the Brookings Insti- 
tution on the chance there might still be a copy of the Pentagon 
papers in there. Today, you are having debates on FOX news: Let's 
do some targeted assassination attempts on Julian Assange. 

Well, I have to say G. Gordon Liddy would be right at home, and 
both is absurd. And the overreaction the government typically does 
is not to kill anybody or to firebomb something but to go right to 
the second major point I want to make today. They are going to 
classify more information. 

What I am worried about most is the backlash. I mean, in my 
prepared statement, I have got multiple examples of all the esti- 
mates, and they range from 50 percent to 90 percent, of what the 
problem of over classification really amounts to. Governor Tom 
Kean, head of the 9/11 Commission, after looking at all of the al 
Qaeda intelligence that we gathered before 9/11, said, you know, 76 
percent of what I saw that was classified should not have been. 
And the Commission said we not only needed to do information 
sharing between the agencies, we had to do information sharing 
with the American people, because that is the only way we can 
really protect ourselves. What a great lesson that is. 

The system is so overwhelmed with the secrets that we can no 
longer really protect the real ones and we can't let out the ones 
that would actually keep us all safer. 

And I think it is a mistake to try to see this as a balancing test. 
It is not a balance between openness and security. The findings of 
the 9/11 Commission were that more openness would have made us 
more secure. That is what you do an in open society to keep your- 
self safe. You are not safer in the dark. You don't hide your 
vulnerabilities. You expose them and you fix them. That is how we 
proceed in America. 

The third point I just want to make about where we are today. 
We are in the middle of a syndrome that one senior government 
official I really respect holds all the clearances, does the audits, 
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pushes back against excessive secrecy, called it Wikimania. We are 
in the middle of Wikimania, and it is going to lead to so much more 
heat than light. Targeted assassination is only the most extreme 
case, but look at all the other proposals we have got on the table 
and the front burners to try to push back, to punish WikiLeaks, to 
push back against speech. 

I think the problem here is we have got to look at each one of 
those proposals and say, is that really going to address the prob- 
lem? Is it going to reduce government secrecy or is it going to add 
to it? Is it going to make us more safe? Is it going to make us more 
free? And do that test. 

The Wikimania is really coming from a series of what in my 
statement I call Wikimyths. There has not been a documents 
dump. Everybody uses that phrase. There hasn't been one. The less 
than 2,000 cables are on the public record today out of that big 
database, and the editors of Le Monde and the Guardian and New 
York Times say that WikiLeaks is consulting with them about 
what to publish, what to redact and doing the dialogue with gov- 
ernment officials in a pretty extraordinary, responsible way. 

It is a very different posture, I should say, than WikiLeaks had 
even 6 or 8 months ago. I think the criticism they have gotten from 
journalists like us and from the public about endangering people's 
Jives in Afghanistan and elsewhere, believe it or not, I think they 
have actually heard it. 

There is no epidemic of leaks. In fact, all four of the big 
WikiLeak publicity spats have come from a single person as far as 
we know, Bradley Manning, a young private. 

So how do you solve the Bradley Manning problem? Well, you 
could do a pretty simple thing. The Defense Department has al- 
ready done it. And here is a rational security policy. Just like you 
got two people to launch nuclear missiles, you have go two people 
to handle a communications manual that has codes in it, have two 
people before you can download something from a secure network. 
Pretty simple. That would have stopped Bradley Manning. Mor- 
mons send out two people as missionaries because that is how you 
have accountability, right? You don't have solos. All right. 

There is no diplomatic meltdown from the WikiLeaks. I mean, 
there is a lot of heatedrhetoric. But Secretary of Defense Robert 
Gates who ought to know — he served every President in my life- 
time, as far as I can tell — and, Mr. Chairman, you quoted his re- 
marks. Yeah, it is awkward, yeah, it is embarrassing, but. no, it 
is not a meltdown. It will make the job harder for diplomats. 
Maybe somebody is going to have to be reassigned. But, you know, 
in the long run, it is probably in the American national security in- 
terest for more foreign governments to be more accountable to their 
own citizens for their diplomacy. It is probably in our national se- 
curity interest for the King of Saudi Arabia to actually be on the 
public record a little more often and the China politburo members 
to get exposed every now and then. That might be a long-term goal 
of what American national security diplomacy ought to be about. 

And, finally, there is not a set of Wiki terrorists. I have heard 
that phrase batted around. They are not terrorists. 

I have to tell you, I wish every terrorist group in the world would 
write the U.S. ambassador in their local town, you know, days or 
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a week before they are about to launch something, and ask the am- 
bassador, hey, would you help us, you know, make sure nobody in- 
nocent gets hurt? Would you really work with us? We would be 
glad to talk to you. 

And I understand why the ambassadors didn't believe them. Be- 
cause WikiLeaks said, oh, and, by the way, we will keep anything 
you say to us confidential. It is hard to square with the previous 
statements of WikiLeaks. 

But I wish every terrorist group would get into partnership with 
Le Monde and El Pais and the Guardian and the New York Times 
to assess what the damage might be, to redact their own docu- 
ments, to put regulators on the bombs they drop. That would be 
a good thing. WikiLeaks is not terrorists. 

And so that brings me to my final real point and recommenda- 
tion to this Committee and to the prosecutors across the river in 
Alexandria: Just restraint. I know you don't usually have witnesses 
come up here and say, hey, let's all go take a nap. But you know 
in sleep-deprived Washington we might could use a little more re- 
straint. 

I would say leave the Espionage Act back in mothballs where it 
is right now and should stay. And in fact what we know is from 
some freedom of information requests there are still some classifi ed 
documents from 1917 that will give the Espionage Act very good 
company. Don't mess with it. Leave it alone. 

Our fundamental test should come out of Justice Stewart's dicta 
in the Pentagon papers case and some wonderful articles that Jack 
Goldsmith has actually written in the last couple of years where 
he says, look, our problem is, you know, the fundamental cause of 
leaks is a sense of illegitimacy that is bred by excessive govern- 
ment secrecy. 

How do you address that? You reduce the secrecy. How do you 
deal with the legitimacy problem? You make sure as few secrets as 
possible are actually held and you protect those very strongly. 

So the test is, for all these proposals, legislative and otherwise, 
does it send a signal that will actually reduce government secrecy? 
Does it send a signal that we need maximum possible disclosure, 
in Stewart's phrase, to have a system that actually has credibility 
and can protect the real secrets and where we can protect our- 
selves? 

I thank you, Mr. Chairman, for this opportunity to engage in this 
debate. I hope it will reduce the mania a little bit and cut through 
some of the myths. Thank you, sir, 

[The prepared statement of Mr. Blanton follows:] 
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Hearing on the Espionage Act and (he Legal and Constitutional 

Implications of WikiUaks 

Thursday. December 16,2010 
Rayburn House Office Building, Room 2141 
Washington D.C. 



Mr. Chairman, Ranking Member Smith, and members of (he Committee, 
thank you for your invitation to testify today on the implications of the 
Wikileaks controversy. I am reminded of the ancient Chinese curse, "May 
you live in interesting times/'* 

I have three main points to make today: 

First, the government always overreacts to leaks, and history shows we end 
up with more damage from the overreaction than from the original leak. 

Second, the government's national security classification system is broken, 
overwhelmed with too much secrecy, which actually prevents the system 
from protecting the real secrets. The rest should ail come out. 

Tiiird, we are well into a syndrome that one senior government official 
called "Wikimanfa," where Wikimyths are common and there is far more 
heat than light - heat that will actually produce more leaks, more 
crackdowns, less accountable government, and diminished security. 

By way of background, I should say right up front that my organization, the 
National Security Archive, has not gotten any 1.6 gigabyte thumb drives in 
the mail in response to our many Freedom of Information Act requests, nor 
have we found any Bradley Mannings among the many highly professional 
FOIA otTicers who handle our cases. It's a lot more work to pry loose 
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national security documents the way we do it, but then it's a lot of work 
worth doing to make the lule of law a reality and give real force to the 
Freedom of Information Act. 

it takes us years of research and interviews and combing the archives and the 
memoirs and the press accounts, even reading the agency phone books, to 
design and file focused requests that don't waste the government's time or 
our time hut hone in on key documents and key decision points, then to. 
follow up with the agencies, negotiate the search process, appeal the denials, 
even go to court when the stonewalling gets out of hand. Changing the iron 
laws of bureaucracy is a tall order, but we have allies and like-minded 
openness advocates in more than 50 countries now, passing access laws and 
opening Politburo and military dictators' files, poring through Communist 
Party records and seciet police archives and death squad diaries, rewriting 
Iristoiy, recovering memory, and bringing human rights abusers to trial. 

Our more than 40,000 Freedom of Information requests have opened up 
millions of pages that were previously classified; we've published more than 
a million pages of documents on the Web and other formats; our staff and 
fellows have authored more than 60 books, one of which won the Pulitzer, 
Our Freedom of Information lawsuits have saved tens of millions of White 
House e-mail spanning from Reagan to Obama, whose Blackberry messages 
are now saved for posterity. 

The George Foster Peabody Award in 1 998 recognized our documentary 
contributions to CNN's Cold War series both from the Freedom of 
information Act and from the Soviet archives; the Emmy Award m2005 
recognized our "outstanding achievement in news and documentary 
research"; and the George Polk Award citation (April 2000) called us "a 
FOIL'ers best friend" and used a wonderful phrase to describe what we do: 
"piercing the self-serving veils of government secrecy, guidingjoumaltsts in 
search for the truth, and informing us all." 

Most pertinent to our discussion here today is our experience with the 
massive overclassifi cation of the U.S. government's national security 
information. Later in tins testimony 1 include some of the expert 
assessments by current and former officials who have grappled with the 
secrecy system and who estimate that between 50% to 90% of what is 
classified is either overelassifie<! or should not be classified at all. That 
reality should restrain us from encouraging government prosecutors to go 
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after anybody who haus unauthorized possession of classified information: 
such encouragement is an invitation for prosecutorial abuse and overreach - 
exactly as we have seen in the case of the lobbyists for the American Israel 
Public Affairs Committee. 

The reality of massive overclassification also points n$ towards remedies tor 
leaks that are the opposite of those on the front burners such as criminalizing 
leaks. The only remedies that will genuinely curb leaks are ones that force 
the government to disgorge most of the information it holds rather than hold 
more information more tightly. 

But a rational response to excessive government secrecy will be even more 
difficult to achieve in the cuirent atmosphere of Wikimania. The heated 
calls for targeted assassinations of leakers and publishers remind me of the 
Nixon White House discussions of firebombing the Brookings Institution on 
suspicion of housing a copy of the Pentagon Papers. It was the earlier leak, 
of the secret btmbing of Cambodia that started President Nixon down the 
path to the Watergate plumbers, who began with righteous indignation about 
leaks, then moved to black bag jobs and break-ins and dirty tricks, and 
brought down the presidency. All the while, as the Doonesbury cartoon 
pointed out, only the American people and Congress were in the dark. One 
famous strip showed a Cambodian couple standing amid bomb wreckage* 
and the interviewer asks, was this from the secret bombing? Oh, no, not a 
secret at all, "1 said, look Martha, here come die bombs." 

Few have gone as far as Nixon, but overreactkm to leaks has been a constant 
in recent American histoiy. Almost every president has tied his White 
House in knots over embarrassing internal leaks; for example, the moment 
of greatest conflict betweenPresident Reagan and his Secretary of State 
George Shultz was not over the Iran-contra affair, but over the idea of 
subjecting Shultz and other liigh officials to the polygraph as part of a leak- 
prevention campaign. President Ford went from supporting to vetoing the 
Freedom of Information Act amendments of 1974 because of his reaction to 
leaks (only to be overridden by Congress), President George W. Bush was 
so concerned about leaks, and about aggrandizing presidential power, that 
his and Vice President Cheney's top staff kept the Deputy Attorney General, 
number two at Justice, out of the loop on the warrantless wiretapping 
program, and didn't even share legal opinions about the program with the 
top lawyers of the National Security Agency that was implementing the 
intercepts, 
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But even with this background, I have been astonished at the developments 
of the last week, with the Air Force and the Libraiy of Congress blocking the 
Wikileaks web site, and warning their staff not to even peek. f should have 
known the Air Force would come up with something like this. The 
Archive's own Freedom of Information Act lawsuit over the last 5 years had 
already established that the Air Force created probably the worst F01A 
processing system in the entire federal government ~ the federal judge in our 
case ruled the Air Force had "miserably failed" to meet the law's 
requirements. But now, apparently, the worslFOiA system has found a 
mate in the worst open-source information system? This policy is 
completely self-defeating and foolish. If Air Force personnel do not look at 
the leaked cables, then they are not doing their job as national security 
professionals. 

Conies now the Librae of Congress, built on Thomas Jefferson's books, 
also blocking access to the Wikileaks site. On the LC blog, a repeated 
question has been when exactly are you going to cut off the New York Times 
site too? One might also ask, when will you remove Bob Woodward's 
books from the shelves? 

Official reactions like these show how we are suffering from "Wikimania." 
Almost all of the proposed cures for Bradley Manning's leak of the 
diplomatic cables are worse than the disease. The real danger of Wikimania 
is that we could revert to Cold War notions of secrecy, to the kind of 
stovepipes and compartments that left us blind before 9/1 1, to mounting 
prosecutions under the Espionage Act that just waste taxpayers' money and 
ultimately get dropped, and to censorship pressure on Internet providers that 
emulates the Chinese nx>del of state control rather than the first 
Amendment. So perhaps a first order of business should be to dissect some 
of what i call the "Wikimyths." 

1, A document dump, 

So far there has been no dump of the diplomatic cables. As of yesterday, 
there were fewer thau2,000 cables posted on the Web in the Wikileaks and 
media sites combined, and another 100 or so uploaded each day, not the 
251,000 that apparently exist in the overall database as downloaded by 
Bradley Manning, And even that set of a quarter-million cables represents 
only a ft action of the total flow of cable traffic to and from the State 
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Department, simply the ones that State staff considered "reporting and other 
informational messages deemed appropriate tor release to the US 
government interagency community" (the Foreign Affairs Manual 
explanation of the SIPDfS tag). According to the editors of l*e Monde and 
The Guardian, Wikileaks is following the lead of the media organizations on 
which documents to post, when to do so, and what to redact from the cables 
in terms o f source identities that might put someone at risk, Such behavior 
is the opposite of a dump. At the same time, an "insurance" file presumably 
containing the entire database in encrypted form is in the hands of 
thousands, and Wikileaks founder Julian Assange has threatened to send out 
the decrypt key, if and when his back is against the wall. So a dump could 
yet happen of the cables, and the prior record is mixed. A dump did begin of 
the Iraq and Afghan war logs, but once reporters pointed out the danger to 
local cooperators from being named in the logs, Wikileaks halted the dump 
and withheld some 15,000 items out of 9 1,000 Afghan records. 

2, An epidemic of leaks. 

While the quantity of documents seems huge (hundreds of thousands 
including the Iraq and Afghan materials), from everytliing we know to date, 
all four tranches of Wikileaks publicity this year have come from a single 
leaker, the Army private Bradley Manning, who is now beliind bars. First, 
in April, was the helicopter video of the 2007 shooting of the Reuters 
cameramen. Then came the Iraq and Afghan war logs (higlily granular 
situation reports for the most part) in July and October. Now we see the 
diplomatic cables from the SIPRNet Between 500,000 and 600,000 U.S. 
military and diplomatic personnel were cleared for SIPRNet access, so a 
security official looking for a glass half full would point out that a human- 
designed security system with half a million potential error points ended up 
only with one. 

A better contrast would be to compare the proposals for dramatic expansion 
of the Espionage Act into arresting foreigners, to the simple operational 
security change that the Defense Department has already implemented, The 
latter would have prevented Manning from doing his solo downloads onto 
CD, and we should ask which approach would be more likely to deter future 
Mannings. State Department officials were gloating last week that no 
embassy personnel could pull a Manning because State's version of the 
SIPRNet wouldn't allow downloads onto walk-away media like thumb 
drives or CDs. Defense's rejoinder was that its wide range of forward 



5 



82 



operating bases, equipment craslies from dust storms and incoming fire, and 
often tenuous Internet connections ~ ceitainly compared to the usually cushy 
conditions inside embassies - meant some download capacity was essential. 
Now, just as nuclear missile launch requires two operators' keys, and the 
handling of sensitive communications intelligence manuals requires "two 
person integrity," and the Mormons send their missionaries out in pairs, a 
SiPRNet download would take two to tango. 

3. A diplomatic meltdown. 

f feadline writers loved this phrase, aided and abetted by official statements 
like Secretary of State Hillary Clinton's characterization of the cables' 
release as an "attack on America" "sabotaging peaceful relations between 
nations.*' In contrast, the Secretary of Defense Robert Gates played down 
the heat, in a much more realistic assessment that bears repeating. Gates 
told reporters two weeks ago, *Tve lieard the impact of these releases on our 
foreign policy described as a meltdown, as a game-changer and so on. I 
think these descriptions are fairly significantly overwrought. . . . Is this 
embarrassing? Yes. Is it awkward? Yes, Consequences for U.S. foreign 
policy? I think fairly modest." Most international affairs scholars are 
calling the cables fascinating and useful, but at least so far nothing in the 
diplomatic cables compares to the impact on public policy in 2004 from the 
leak of the Abu Ghraib photographs, or other recent leaks of the existence of 
the secret prisons, or the torture memos, or the fact of warrantless 
wiretapping, or even the Pentagon Papers' contribution to the end of the 
Vietnam war* 

4. Alternatively, no news here. 

Wikileaks critics who were not bemoaning a global diplomatic meltdown 
often went to the opposite extreme, that is to say there was nothing really 
new in the Bradley Manning cables. The past two weeks' worth of front- 
page headlines in the leading newspapers and broadcasts around the world 
should lay tin's myth to rest. Folks with more news judgment than we have 
in this room are continuing to assign stories from the cables, and foreign 
media in particular are getting an education perhaps more valuable for their 
understanding of their own countries than of the U.S. Likewise, the blogs 
are full of lists of stories showing all the things we didn't know before the 
cables emerged. The real problem with the modern news media is evident 
from the fact that there are many more reporters clustered around the British 
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jail holding Assangc, than there arc reporters in newsrooms actually reading 
the substance of the documents. Celebrity over substance every time. 

5. Wild terrorists. 

I wish all terrorist groups would write the local U.S. ambassador a few days 
before they are launching anything - the way Julian Assange wrote 
Ambassador Louis Susman in London on November 26 to ask for 
suggestions on how to make sure nobody gets hurt. I can certainly 
understand the State Department's hostile response and refusal to engage 
with Assange in the kind of dialogue U.S. government ottlcials routinely 
have with mainstream media, and were already having with the New York 
Times over these particular cables. Given Wikileaks's piior stance, who in 
State could possibly have taken at face value the phrase in the November 26 
letter which says "Wikileaks will respect the confidentiality of the advice 
provided by the United States Government" about risk to individuals. 

But \ wish all terrorist groups would partner up with Le Monde and HI Pma 
and Ber Spiegel and The Guardian, and The New York Times, and take the 
guidance of those professional journalists on what bombs go off and when 
and with what regulators. Even to make the comparison tells the story- 
Wikileaks is not acting as an anarchist group, even remotely as terrorists, but 
as a part of the media, as publishers of information, and even more than that 
- the evidence so far shows them tiying to rise to the standards of 
professional journalism. 

1 was quoted in Sunday's New York Times as saying "Fin watching 
Wikileaks grow up" as they embrace the mainstream media which "they 
used to treat as a cuss word." So far, with only a few mistakes to date, the 
treatment of the cables by the media and by Wikileaks has been veiy 
responsible, incorporating governmental feedback on potential damage, 
redacting names of sources, and even withholding whole documents at the 
government's request. Of course, Assange and his colleagues could revert to 
more adolescent behavior, since there is the threat out there of the enciypted 
"insurance" file that would be dropped like a pinata if the organization 
reaches dire straits. But even then, even if all the cables went online, most 
of us would condemn the recklessness of such ail action, but the fundamental 
media and publisher function Wikileaks is seiving would not change. 
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6. When the government says it's classified, our job as citizens is to 
salute. 

Actually our job as citizens is to ask questions. I have mentioned that 
experts believe 50% to 90% of our national security secrets could be public 
with little or no damage to real security. A few years back, when Rep. 
Christopher Shays (R-CT) asked Secretary of Defense Donald Rumsfeld's 
deputy for counterintelligence and security how much governn>ent 
information was overclassified, her answer was 50%. After the 9/11 
Commission reviewed (he government's most sensitive records about Osama 
bin Laden and Al-Qaeda, the co-chair of that commission, former Governor 
of New Jersey Tom Kean, commented that "thrce-quaiters of what I read 
that was classified shouldn't have been" - a 75% judgment. President 
Reagan's National Security Council secretaty Rodney McDaniel estimated 
in 1991 that only 10% of classification was for "legitimate protection of 
secrets" - so 90% unwarranted. Another data point comes from the 
Interagency Security Classification Appeals Panel, over the past 1 5 years, 
lias overruled agency secrecy claims in whole or in part in some 65% of its 
cases. 

When two of the Cl A's top officers retired and went into business, the 
Washington Post's Dana Hedgpeth asked them what was most surprising 
about being in the private sector. Cofer Black and Robert Richer responded 
that "much of the information they once considered top secret is publicly 
available. The trick, Richer said, is knowing where to look. 'In a classified 
area* there's an assumption that if it is open, it can't be as good as if you 
stole it, 5 Richer said. Tm seeing that at least SO percent of what we stole 
was open.'" ("Blackwater's Owner Has Spies for Hire," by Dana Hedgpeth, 
Washington Post, November 3, 2007). And this was before the Bradley 
Maiming leaks. 

In the National Security Archive's collections, we have dozens of examples 
of documents that are classified and unclassified at the same time, 
sometimes with difT erent versions from different agencies or different 
reviewers, all because the secrecy is so subjective and overdone. My own 
favorite example is a piece of White House e-mail from the Reagan years 
when top officials were debating how best to help out Saddam Hussein 
against the Iranians. The first version that came back from our Freedom of 
Tnfonnationiawsuit had large chunks of the middle section blacked out on 
national security grounds, classified at the secret level as doing serious 
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damage to our national security if released. But the second version, only a 
week or so later, had almost no black in the middle, but censored much of 
the top and the bottom sections as secret. Slide the two versions together 
and you could read practically the entire document. The punch line is: This 
was the same reviewer both times, just with almost completely contradictory 
notions of what needed to stay secret. 

The Associated Press reported last week (December 9, 20 10) that reporter 
Matt Apuzzo's review of the Bradley Maruiing cables "unmasked another 
closely guarded fact; Much of what the government says is classified isn't 
much of a secret at all. Sometimes, classified documents contained little 
more than summaries of press reports. Political banter was treated as 
confidential government intelligence. Information that's available to anyone 
with an Internet connection was ordered held under wraps for years.*' The 
first example AP cited was a cable from the U.S. Embassy i n Ottawa 
briefing President Obama in early 2009 for an upcoming trip to Canada, a 
cable which "included this sensitive bit of information, maiked confidential: 
*No matter which political party forms the Canadian government during 
your Administration, Canada will remain one of our staunchest and most 
like-minded of allies, our largest trading and energy partner, and our most 
reliable neighbor and friend.' The document could not be made public until 
2019, for national security reasons," the AP repoited. 

Among other issues raised by Ihe AP reporting is the fact that more lhaii half 
of the Bradley Manning cables are themselves unclassified to begin with. 
Why did these items n*ed to be buried inside a system that went up to the 
secret level? Why couldn't those unclassified cables go up on the State 
Department's own public Web site? Are they really all press summaries and 
administiivia? Do they need any farther review such as for privacy or law 
enforcement issues? What objection would the government have to pre- 
empting Wikileaks by posting these - that somehow it would be rewarding 
illicit behavior? 

Bringing the reality of overcktssif ication to the subject of leaks, Harvard law 
professor Jack Goldsmith, who seived President George W. Bush as head of 
the controversial Office of Legal Counsel at the Justice Department, has 
written, "A root cause of the perception of illegitimacy inside the 
government that led to leaking (and then to occasional irresponsible 
reporting) is, ironically, excessive government secrecy." Goldsmith went 
on, i n what was otherwise a highly critical review of the New York Times* 
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coverage of wiretapping during the George W. Bush years ("Secrecy and 
Safety "by Jack Goldsmith, Ttw New Republic, August 13, 2008), to point 
out, "The secrecy of tlie Bush administration was genuinely excessive, and 
so it was self-defeating. One lesson of the last seven years is that the way 
for the government to keep impoitant secrets is not to draw the normal circle 
of secrecy tighter. Instead the government should be as open as possible. . . 

Goldsmith's analysis draws on the famous dicta of Justice Potter Stewart in 
the Pentagon Papers case: "When everything is classified, then notliing is 
classified, and the system becomes one to be disregarded by the cynical or 
the careless, and to be manipulated by those intent on self-protection or self- 
promotion." In fact, Stewart observed, 4< the hallmark of a truly effective 
internal security system would be the maximum possible disclosure" since 
"secrecy can best be preserved only when credibility is truly maintained " 

Between Goldsmith and Stewart, then, Mr. Chairman, we have a pretty good 
guide with which to assess any of the proposals that may come before you in 
the guise of dealing with Wikileaks in these next months. We have to ask, 
will the proposal draw the circle of secrecy tighter, or move us towards 
maximum possible disclosure? We have to recognize that right now, we 
have low fences around vast prairies of government secrets, when what we 
need are high fences around small graveyards of the real secrets. We need to 
clear out our backlog of historic secrets that should long since have appeared 
on the public shelves, and slow the creation of new secrets. And those 
voices who argue for a crackdown on leakers and publishers need to face the 
reality that their approach is fundamentally self-defeating because it will 
increase government secrecy, reduce our security, and actually encourage 
more leaks from the continued legitimacy crisis of the classif ication system. 

Thank you for your consideration of these views, and I look forward to your 
questions. 
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THE IMPACT ON INFORMATION SHARING 

PART I 



Thursday, March 22, 2007 

U.S. House of Representatives, 
Committee on homeland Security, 
Subcommittee on Intelligence, Information Sharing, 

and Terrorism Risk Assessment, 

Washington, DC. 

The subcommittee met, pursuant to call, at 10:09 a.m., in Room 
311, Cannon House Office Building, Hon. Jane Harman [chair- 
woman of the subcommittee] presiding. 

Present: Representatives Harman, Langevin, Thompson, 
Reichert, and Dent. 

Ms. HARMAN. [Presiding.] The subcommittee will come to order. 

The chair apologizes for a late start. Even though my party is in 
the majority, I don't run the schedule here, and there was a con- 
flicting hearing on emergency interoperability, and I was asking 
questions of witnesses. And that subject, obviously, is directly rel- 
evant to some of the tasks of this subcommittee, so I hope you will 
forgive me. 

A recurrent theme throughout the 9/11 Commission's report was 
the need to prevent widespread over-classification by the federal 
government. The commission found that over-classification inter- 
feres with sharing critical information and impedes efficient re- 
sponses to threats. 

The numbers tell us we are still not heeding the commission's 
warning. Eight million new classification actions in 2001 jumped to 
14 million new actions in 2005, while the quantity of declassified 
pages dropped from 100 million in 2001 to 29 million in 2005. In 
fact, some agencies were recently discovered to be withdrawing 
archived records from public access and reclassifying them. 

Expense is also a problem. $4.5 billion spent on classification in 
2001 increased to $7.1 billion in 2004, while declassification costs 
fell from $232 million in 2001 to $48.3 million in 2004. 

In addition, an increasing number of policies to protect sensitive 
but unclassified from a range of federal agencies and departments 
has begun to have a dramatic impact. At the federal level, over 28 
distinct policies for the protection of this information exists — 28 
distinct policies. That is almost as many policies as we have watch 
lists — that was intended to be humorous. 

Unlike classified records, moreover, there is no monitoring of, or 
reporting on, the use or impact of protective, sensitive, unclassified 
information markings. The proliferation of these pseudo-classifica- 

(l) 
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tions is interfering with the interagency information sharing, in- 
creasing the cost of information security and limiting public access. 

Case in point, this document from the Department of Homeland 
Security. This document, which I cannot release to you or the 
press, is called, "Special Assessment: Radicalization in the State of 
California," a survey, and it is dated the 22nd of November, 2006. 

In a few weeks, I will be leading a field hearing to Torrance, 
California to examine the issues of domestic radicalization and 
homegrown terrorism, but this DHS document, a survey, as I men- 
tioned, is marked, "unclassified, for official use only." 

On page one, in a footnote, the survey states that it cannot be 
released "to the public, the media or other personnel who do not 
have a valid need to know without prior approval of an authorized 
DHS official." 

Our staff requested and was denied an approval. Staff also asked 
for a redacted version of the document so we could use at least 
some of its contents at the coming California hearing. DHS was un- 
able to provide one. 

Let me be clear, and I say this as someone who served for 8 
years on the House Intelligence Committee, I am not denying that 
there may be sensitive information included in this survey and in 
lots of products prepared by our government, but it illustrates my 
point. 

What good is unclassified information about threats to the home- 
land if we can't even discuss them at a public hearing where the 
public is supposed to understand what some of those threats may 
be? How can we expect DHS and others to engage the public on 
important issues like domestic radicalization if we hide the ball? 

Unfortunately, this is nothing new. In 1997, the Moynihan Com- 
mission stated that the proliferation of these new designations are 
often mistaken for a fourth classification level, causing unclassified 
information with these markings to be treated like classified infor- 
mation. 

These continuing trends are an obstacle to information sharing 
across the federal government and vertically with state, local and 
tribal partners, including most especially with our partners in the 
law enforcement community. 

And in our second panel, we are going to hear from some of those 
partners, including Chief Lanier, and I want to welcome her today 
and congratulate her again on being one of the youngest ever police 
chiefs in the nation and a very well-qualified person to hold this 
position. 

Until we have a robust intelligence and information-sharing sys- 
tem in place in this country with a clear and understandable sys- 
tem of classification, we run the risk of not being able to prevent 
a terrorist attack on the scale of 9/11 or greater, and I would even 
add on the scale of 9/11 or smaller. We are hurting ourselves by 
the way we unnecessarily protect information. 

This is why this subcommittee will focus some of its efforts in the 
110th Congress on improving information sharing with our first 
preventers, the men and women of state, local and tribal law en- 
forcement who are the eyes and ears on our frontlines. We will do 
this work in the right way, partnering with our friends in the pri- 
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vacy and civil liberties community who want to protect America 
while serving our cherished rights. 

I would like to extend a warm welcome to our witnesses who will 
be talking about these issues, first, some organizations, and then, 
two, on the frontlines in our law enforcement organizations. 

On our first panel, we have assembled an array of experts who 
will be testifying about the extent of these problems and where are 
things are trending, and, as I mentioned, our second panel will give 
us some real-life experiences where classification — and I don't want 
to put words in their mouths, but I have read their testimony — is 
an obstacle rather than some form of benefit to them in their role 
to prevent, disrupt and protect the American public. 

In addition, I hope witnesses will provide some constructive sug- 
gestions about how we might solve this problem, with the goal of 
ensuring the flow of information, the unfettered flow of necessary 
information between the federal government and state, local and 
tribal governments. 

Welcome to all. 

I now yield to the ranking member for opening remarks. 

Mr. Reichert. Thank you, Madam Chair, and thank you for or- 
ganizing this hearing. It is a pleasure to be here this morning. 

And thank all of you for being here in time from your busy 
schedule to come and testify before us. 

We are all here this morning to discuss one of the subcommit- 
tee's major priorities, this over-classification and pseudo-classifica- 
tion. Over-classification, as most of you know, refers to decisions by 
the federal government to routinely restrict access to information 
using the designation, "confidential," "secret" or "top-secret." 

Pseudo-classification is a similar practice applied to sensitive but 
unclassified information. This practice involves federal, state or 
local entities adding restrictions based on internal policies. The 
GAO has found that there are at least 56 different sensitive but 
unclassified designations at the federal level — 56. 

Common examples include, "for official use only," "sensitive but 
unclassified," "sensitive security information," and "law enforce- 
ment sensitive." Some of these designations make sense; some 
don't. Some, there is a real need to protect classified and sensitive 
information from disclosure. 

In a world where virtually piece of unclassified information is 
available on the Internet, we need to ensure that what needs to be 
protected remains protected. The lives of our federal, state and 
local agents in the field often depend on it. 

But as a classic military strategist once said, "If you try to pro- 
tect everything, you wind up protecting nothing." The more secrets 
you keep, the harder they are to keep. I can't tell you how many 
times I have emerged from a secret briefing only to find out that 
everything that I have just learned has already been in the news- 
paper. 

As a former. sheriff, I have vivid memories of the federal govern- 
ment telling me that I could not access information that I needed 
to do my job because it was classified or otherwise restricted. And 
I have also watched as the federal government has taken sensitive 
information from the state and local law enforcement and treated 
it without regard for its sensitivity. 
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I am just going to share a real brief story with you. Years ago, 
when we arrested our suspect in the Green River murder case, a 
serial murder case nationally known, internationally known as one 
of the worst serial murder cases in the world of 50 victims, the FBI 
was a part of that team. They produced paperwork connected and 
associated with that case. 

Once the person was arrested and charged, of course, there was 
a request by the defense attorney for information. The FBI would 
not release the information to substantiate and help our case be- 
cause they said it was classified. 

The fear there was this: Of course, they had information that we 
would have lost our case. Eventually, they came forward, presented 
the information for discovery; however, the fear was that because 
of the state laws that existed in the state of Washington, every- 
thing they disclosed then would be subject to public disclosure 
laws. So anything they released to us, the sheriff's office is required 
by state law to give that to the news media. So that was their con- 
cern. 

We have a lot of issues here to discuss today. I am not going to 
finish the rest of my statement. We are just happy to have you 
here, and you know that we understand the problem, and we are 
looking to help you find solutions. 

Thank you. 

Ms. HARMAN. I thank the ranking member and note that his ex- 
perience as a sheriff is extremely useful to this subcommittee as we 
pursue issues like this. 

The chair now recognizes the chairman of the full committee, the 
gentleman from Mississippi, Mr. Thompson, for an opening state- 
ment. 

Mr. Thompson. Thank you, Madam Chair. I join you in wel- 
coming our distinguished witnesses today to this important hearing 
on the problem of over-and pseudo-classification of intelligence. 

Information sharing between the federal government and its 
state, local and tribal partners is critical to making America safer, 
but we won't get there if all we have is more and more classifica- 
tion and more and more security clearances for people who need ac- 
cess to that classified information. 

The focus should be different. The federal government instead 
must do all it can to produce intelligence products that are unclas- 
sified. Unclassified intelligence information is what our nation's po- 
lice officers, first responders and private sector partners need most. 
They have told me time and time again that what they don't need 
is information about intelligence sources and methods. 

And I think all of us have been in enough briefings that were 
somehow classified at varying levels only to see it on the evening 
news and be shocked that, well, why would you keep it from mem- 
bers of Congress when all we have to do is delay the briefing 6 
hours and we can see it? That occurred last week. 

I am sure Mr. Langevin understands very well. We had a brief- 
ing that we were told that was top-secret, took the BlackBerrys, 
took the cell phones, and, lo and behold, it was on the 5 p.m. news. 

So to some degree, the over-classification is a problem. 

If we are going to successfully address terrorism, then we have 
to share the information in real time and trust our partners to 



VerOate Nov24 2008 15:42 Jun 07,2009 M 0OOOO0 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 H:\DOCS\110-HRGS\110 20\35279.TXT HSEC PsN: DIANE 



5 



some degree. If we can't trust law enforcement, if we can't trust 
first responders, who can we trust? 

So I think it is a hearing that is pertinent to the challenge that 
we face. I look forward to the testimony of the witnesses, and, obvi- 
ously, this is one of many, Madam Chair. I am sure we will be par- 
ticipating in over this session. 

I yield back. 

Ms. HARMAN. I thank the chairman and would point out that 
other members of the subcommittee can submit opening statements 
for the record, under our rules. 

I now welcome our first panel of witnesses. 

Our first witness, Mr. Bill Leonard, is the director of the Infor- 
mation Security Oversight Office at the National Archives. Mr. 
Leonard's office has policy oversight of the entire federal govern- 
ment-wide security classification system — that is a mouthful — and 
he reports directly to the president. 

His office receives his policy and program guidance from the na- 
tional Security Council. More than 60 executive branch agencies 
create or handle classified national security information, and Mr. 
Leonard's work in this capacity impacts all of them. 

Welcome, Mr. Leonard. 

Our second witness is my Washington, D.C., neighbor and good 
friend, Scott Armstrong. Mr. Armstrong is the executive director of 
Information Trust, a nonprofit group that works toward opening 
access to government information. 

He has been inducted into the FOIA Hall of Fame — congratula- 
tions — and was awarded the James Madison Award by the Amer- 
ican Library Association in 1992. Mr. Armstrong has been a Wash- 
ington Post reporter and is the founder of the National Security Ar- 
chive at George Washington University. 

Our third witness, Meredith Fuchs, serves as the general counsel 
to the nongovernmental National Security Archives. At the Ar- 
chives, she overseas Freedom of Information Act, called FOIA, and 
anti-secrecy litigation and frequently lectures on access to govern- 
ment information. 

She has supervised five government-wide audits of federal agen- 
cy FOIA performance and one focused on the proliferation of sen- 
sitive but unclassified information labels. 

Without objection, the witnesses' full statements will be inserted 
in the record, and I would hope you could summarize in 5 minutes 
or less — we have a little timer for your benefit — your written testi- 
mony, and then hopefully we can have a lively exchange of views. 

Let's start with Mr. Leonard. 

STATEMENT OF J. WILLIAM LEONARD, DIRECTOR, 
INFORMATION SECURITY OVERSIGHT OFFICE, NATIONAL 
ARCHIVES AND RECORDS ADMINISTRATION 

Mr. Leonard. Chairwoman Harman, Mr. Reichert, Chairman 
Thompson and members of the subcommittee, I wish to thank you 
for holding this hearing this morning on issues relating to the very 
real challenge of over-classification. 

The classification system and its ability to restrict the dissemina- 
tion of information, the unauthorized disclosure of which would re- 
sult in harm to our nation and its citizens, represents a funda- 
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mental tool at the government's disposal to provide for the common 
defense. 

As with any tool, the classification system is subject to misuse 
and misapplication. When information is improperly declassified or 
not classified in the first place, although clearly warranted, our 
citizens, our democratic institutions, our homeland security and our 
interactions with foreign nations can be subject to potential harm. 

Conversely, too much classification or the failure to declassify in- 
formation as soon as it no longer satisfies the standards for contin- 
ued classification unnecessarily obstructs effective information 
sharing and impedes an informed citizenry, the hallmark of our 
democratic form of government. 

In the final analysis, inappropriate classification activity of any 
nature undermines the integrity of the entire process and dimin- 
ishes the effectiveness of this critical national security tool. 

In this time of constant and unique challenges to our national se- 
curity, it is the duty of all of us engaged in public service to do ev- 
erything possible to enhance the effectiveness of this tool. To be ef- 
fective, the classification process is a tool that must be wielded 
with precision. Few, if any, both within and outside of government, 
would deny that too much of the information produced by our agen- 
cies is classified. 

In an audit of agency classification activity conducted by my of- 
fice approximately one year ago, we discovered that even trained 
classifiers, with ready access to the latest classification and declas- 
sification guides, and trained in their use, got it clearly right only 
64 percent of the time in making determinations as to the appro- 
priateness of classification. This is emblematic of the daily chal- 
lenges confronting agencies when ensuring that the 3 million plus 
cleared individuals with at least a theoretical ability to derivatively 
classify information get it right each and every time. 

In response to the findings of this audit, last year I wrote to all 
agency heads and made a number of recommendations for their 
consideration. Collectively, these recommendations help preserve 
the integrity of the classification system while at the same time re- 
duce inefficiencies and cost. I have included a list of these rec- 
ommendations in my prepared formal testimony. 

Recognizing that a focus of this hearing includes policies and pro- 
cedures for handling sensitive, unclassified information, it is impor- 
tant to articulate recent initiatives by the president to ensure the 
robust and effective sharing of terrorism information vital to pro- 
tecting Americans and the homeland from terrorist attacks. 

To that end, the president has mandated the standardization of 
procedures for designated marking and handling sensitive but un- 
classified information across the federal government. Once imple- 
mented, our nation's defenders will be able to share controlled, un- 
classified information more rapidly and confidently. 

The existence of such an option should significantly reduce the 
incentive to over-classify information. That happens now, in part, 
due to the absence of a dependable regime for the proper protection 
of sensitive information which should not be classified. 

Again, thank you for inviting me here this morning, Madame 
Chair, and I would be happy to answer your questions or those 
that the subcommittee might have. 
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[The statement of Mr. Leonard follows:] 

Prepared Statement of J. William, Leonard 
March 22, 2007 

Chairwoman Hannan, Mr. Reichert, and members of the subcommittee, I wish to 
thank you for holding this hearing on issues relating to the very real challenge of 
overclassification of information within the Federal Government as well as for invit- 
ing me to testify today. 

By section 5.2 of Executive Order 12958, as amended, "Classified National Secu- 
rity Information" (the Order), the President established the organization I direct, 
the Information Security Oversight Office, often called "ISOO." We are within the 
National Archives and Records Administration and by law and Executive order (44 
U.S.C. 2102 and sec. 5.2(b) of E.O. 12958) are directed by the Archivist of the 
United States, who appoints the Director of ISOO, subject to the approval of the 
President. We also receive policy guidance from the Assistant to the President for 
National Security Affairs. Under the Order and applicable Presidential guidance, 
ISOO has substantial responsibilities with respect to the classification, safe- 
guarding, and declassification of information by agencies within the executive 
branch. Included is the responsibility to develop and promulgate directives imple- 
menting the Order. We have done this through ISOO Directive No. 1 (32 CFR Part 
2001) (the Directive). 

The classification system and its ability to restrict the dissemination of informa- 
tion the unauthorized disclosure of which would result in harm to our nation and 
its citizens represents a fundamental tool at the Government's disposal to provide 
for the "common defense." The ability to surprise and deceive the enemy can spell 
the difference between success and failure on the battlefield. Similarly, it is nearly 
impossible for our intelligence services to recruit human sources who often risk their 
lives aiding our country or to obtain assistance from other countries' intelligence 
services, unless such sources can be assured complete and total confidentiality. Like- 
wise, certain intelligence methods can work only if the adversary is unaware of their 
existence. Finally, the successful discourse between nations often depends upon con- 
fidentiality and plausible deniability as the only way to balance competing and di- 
vergent national interests. 

As with any tool, the classification system is subject to misuse and misapplication. 
When information is improperly declassified, or is not classified in the first place 
although clearly warranted, our citizens, our democratic institutions, our homeland 
security, and our interactions with foreign nations can be subject to potential harm. 
Conversely, too much classification, the failure to declassify information as soon as 
it no longer satisfies the standards for continued classification, or inappropriate re- 
classification, unnecessarily obstructs effective information sharing and impedes an 
informed citizenry, the hallmark of our democratic form of government. In the final 
analysis, inappropriate classification activity of any nature undermines the integrity 
of the entire process and diminishes the effectiveness of this critical national secu- 
rity tool. Consequently, inappropriate classification or declassification puts today's 
most sensitive secrets at needless increased risk. 

The challenge of overclassification is not new. Over 50 years ago, Congress estab- 
lished the Commission on Government Security (known as the '^Vright Commis- 
sion"). Among its conclusions, which were put forth in 1955, at the height of the 
Cold War, was the observation that overclassification of information in and of itself 
represented a danger to national security. This observation was echoed in just about 
every serious review of the classification systems since to include: the Commission 
to review DoD Security Policies and Practices (known as the "Stillwell Commission") 
created in 1985 in the wake of the Walker espionage case; the Joint Security Com- 
mission established during the aftermath of the Ames espionage affair; and the 
Commission on Protecting and Reducing Government Secrecy (otherwise known as 
the "Moynihan Commission"), which was similarly established by Congress and 
which issued its report in 1997. 

More recently, the National Commission on Terrorist Attacks on the United 
States (the "9 11 Commission"), and the Commission on the Intelligence Capabili- 
ties of the United States Regarding Weapons of Mass Destruction (the "WMD Com- 
mission") likewise identified overclassification of information as a serious challenge 

It is Executive Order 12958, as amended, that sets forth the basic framework and 
legal authority by which executive branch agencies may classify national security 
information. Pursuant to his constitutional authority, and through the Order, the 
President has authorized a limited number of officials to apply classification to cer- 
tain national security related information. In delegating classification authority the 



VerDate Nov24 2008 15:42 Jun 07, 2009 Jkt OOOOOO PO 00000 Frm 0001 1 Fmt6633 Sfmt 6621 H:\DOCS\110HRGS\110-20\35279.TXT HSEC PsN: DIANE 



8 



President has established clear parameters for its use and certain burdens that 
must be satisfied. 

Specifically, every act of classifying information must be traceable back to its ori- 
gin as an explicit decision by a responsible official who has been expressly delegated 
original classification authority. In addition, the original classification authority 
must be able to identify or describe the damage to national security that could rea- 
sonably be expected if the information was subject to unauthorized disclosure. Fur- 
thermore, the information must be owned by, produced by or for, or under the con- 
trol of the U. S. Government; and finally, it must fall into one or more of the cat- 
egories of information specifically provided for in the Order, 1 

The President has also spelled out in the Order some very clear prohibitions and 
limitations with respect to the use of classification. Specifically, for example, in no 
case can information be classified in order to conceal violations of law, inefficiency, 
or administrative error, to restrain competition, to prevent embarrassment to a per- 
son, organization, or agency, or to prevent or delay the release of information that 
does not require protection in the interest of national security. 

It is the responsibility of officials delegated original classification authority to es- 
tablish at the time of their original decision the level of classification (Top Secret, 
Secret, and Confidential), as well as the duration of classification, which normally 
will not exceed ten years but in all cases cannot exceed 25 years unless an agency 
has received specific authorization to extend the period of classification. 

As I stated earlier, the ability and authority to classify national security informa- 
tion is a critical tool at the disposal of the Government and its leaders to protect 
our nation and its citizens. In this time of constant and unique challenges to our 
national security, it is the duty of all of us engaged in public service to do every- 
thing possible to enhance the effectiveness of this tool. To be effective, the classifica- 
tion process is a tool that must be wielded with precision. Few, if any, both within 
and outside Government, would deny that too much of the information produced by 
our agencies is classified. In an audit of agency classification activity conducted by 
my office approximately one year ago, we discovered that even trained classifiers, 
with ready access to the latest classification and declassification guides, and trained 
in their use, got it clearly right only 64 percent of the time in making determina- 
tions as to the appropriateness of classification. This is emblematic of the daily chal- 
lenges confronting agencies when ensuring that the 3 million plus cleared individ- 
uals with at least theoretical ability to derivatively classify information get it right 
each and every time. 

In response to the findings of this audit, last year I wrote to all agency heads and 
made a number of recommendations for their consideration. Collectively, these rec- 
ommendations help preserve the integrity of the classification system while at the 
same time reduce inefficiencies and cost. They included: 

• Emphasizing to all authorized holders of classified information the affirma- 
tive responsibility they have under the Order to challenge the classification sta- 
tus of information that they believe is improperly classified (§ 1.8(a) of the 
Order). 

• Requiring the review of agency procedures to ensure that they facilitate clas- 
sification challenges (§ 1.8(b) of the Order), In this regard, agencies were encour- 
aged to consider the appointment of impartial officials whose sole purpose is to 
seek out inappropriate instances of classification and to encourage others to ad- 
here to their individual responsibility to challenge classification, as appropriate. 

• Ensuring that quality classification guides of adequate specificity and clarity 
are prepared and updated to further accurate and consistent derivative classi- 
fication decisions (§ 2.2 of the Order). 

• Ensuring the routine sampling of recently classified information to determine 
the propriety of classification and the application of proper and f ull markings 
(§ 5.4(dX4) of the Order). Consideration should be given to reporting the results 
of these reviews to agency personnel as well as to the officials designated above 
who would be responsible to track trends and assess the overall effectiveness 
of the agency's efforts and make adjustments, as appropriate. 



1 Pursuant to §1.4 of the Order, information shall not be considered for classification unless 
it concerns: (a) military plans, weapons systems, or operations; (b) foreign government informa- 
tion; (c) intelligence activities (including special activities), intelligence sources or methods, or 
cryptology; (d) foreign relations or foreign activities of the United States, including confidential 
sources; (e) scientific, technological, or economic matters relating to the national security, which 
includes defense against transnational terrorism; (0 United States Government programs for 
safeguarding nuclear materials or facilities; (g) vulnerabilities or capabilities of systems, instal- 
lations, infrastructures, projects, plans, or protection services relating to the national security, 
which includes defense against transnational terrorism; or (h) weapons of mass destruction. 
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• Ensuring that information is declassiiied as soon as it no longer meets the 
standards for classification (73.1(a) of the Order), 

• Ensuring that prior to exercising the national security exemption as set forth 
in 5 U.S.C. 552b(l) when responding to FOIA requests, that agency personnel 
verify that the information involved clearly meets the standards for continued 
classification irrespective of the markings, to include declassification instruc- 
tions, contained on the document. 

Recognizing that a focus of this hearing includes policies and procedures for han- 
dling sensitive unclassified information, it is important to articulate recent initia- 
tives by the President to ensure the robust and effective sharing of terrorism infor- 
mation vital to protecting Americans and the Homeland from terrorist attacks. To 
that end, the President has promulgated a set of guidelines and requirements that 
represent a significant step in the establishment of the Information Sharing Envi- 
ronment (ISE) called for by section 1016 of the Intelligence Reform and Terrorism 
Prevention Act of 2004 (IRTPA). 

Specifically, to promote and enhance the effective and efficient acquisition, access, 
retention, production, use, management, and shaiing of Sensitive But Unclassified 
(SBU) information, including homeland security information, law enforcement infor- 
mation, and terrorism inf ormation, the President has mandated the standardization 
of procedures for designating, marking, and handling SBU information across the 
Federal Government. A clear mandate for achieving this goal has been laid out for 
the entire Executive branch and significant progress is underway to develop for the 
President's consideration standardized procedures for handling controlled unclassi- 
fied information. Once implemented, our nation's defenders will be able to share 
controlled unclassified information more rapidly and confidently. The existence of 
such an option should significantly reduce the incentive to overclassify information. 
This happens now, in part, due to the absence of a dependable regime for the proper 
protection of sensitive information which should not be classified. 

Again, I thank you for inviting me here today, Madame Chairwoman, and I would 
be happy to answer any questions that you or the subcommittee might have at this 
time. 

Ms. HARMAN. I thank the witness. 
Now, we will hear from Mr. Armstrong. 

STATEMENT OF SCOTT ARMSTRONG, FOUNDER, 
INFORMATION TRUST 

Mr. ARMSTRONG. Thank you, Madam Chair. Thank you. I am 
pleased to be able to discuss these issues with this subcommittee, 
given the membership of the subcommittee and the full committee 
include many of the people that have provided the leadership, or 
attempted to provide the leadership, to dig into these difficult ques- 
tions on this committee and other committees of the Congress. 

I am here on my own, of course, but I also would like to note that 
I participate in a dialogue, which is presently sponsored by the 
Aspen Institute, between the senior journalists, editors, publishers 
and high-level U.S. government officials from various national se- 
curity intelligence agencies. 

The purpose of the dialogue has been to address recurring con- 
cerns about the handling of classified information, the fact that 
sensitive information can find its way into the major media and 
could potential cause damage. 

The discussions have included the attorney general, the director 
of Central Intelligence, the deputy director of National Intelligence, 
ranking members from the National Security Council, the Depart- 
ment of Defense, the National Security Agency, the FBI, the CIA, 
the Department of Homeland Security and the Department of Jus- 
tice. 

The dialogue is continuing with a variety of initiatives that I 
hope will further involve members of this committee and your col- 
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leagues and members of your staff, and we will be in consultation 
with you on that issue. 

I would like to note three major areas today out of my testimony. 
Twenty-two years ago, in 1985, when I left the Washington Post, 
to found the National Security Archive, I went to the man who was 
then considered the maven of secrecy in the Reagan administra- 
tion, General Richard Stillwell, and I developed an interesting and 
productive dialogue with General Stillwell who was chairing a com- 
mission to examine systemic vulnerabilities in the classification 
system. 

At that time, the Reagan administration's concern was not so 
much news media leaks but the fact that there were significant 
leaks in the form of espionage. General Stillwell not only quoted, 
and usually misquoted, a sentence in Supreme Court Justice Potter 
Stewart's concurrence in the Pentagon Papers case, "When every- 
thing is classified, then nothing is classified," but he finished that 
sentence, "And the system becomes one to be disregarded by the 
cynical or the careless and to be manipulated by those intent on 
self -protection or self -promotion." 

Like Justice Stewart, General Stillwell believed that the hall- 
mark of a truly effective internally security system would be the 
maximum possible disclosure, recognizing that secrecy can best be 
preserved only when credibility is maintained. 

Regrettably, the system then pertained a systemic use of special 
access programs and other compartmented intelligence controls by 
those that have now been extended even on classified information 
and created a labyrinth of security measures, often unaccountable 
and sometimes wholly unauthorized. That situation has not 
changed in the ensuing 20 years. 

My experience has reinforced the notion that government needs 
to spend less energy on calculating how to punish unauthorized 
disclosures of politically sensitive information to the news media 
and more on distinguishing the truly sensitive information which 
must be protected. Once that information is identified as properly 
warranting protection, government officials and the news media 
have shown a willingness to honor reasonable requirements. 

The second issue is the question that this Congress addressed — 
the House addressed in 2002 when it passed the Homeland Secu- 
rity Information Sharing Act, which became part of the Homeland 
Security Act of 2004. It mandated the creation of a unique category 
of information, known as sensitive homeland security information, 
which was sensibly designed to allow this necessary sharing of in- 
formation with state and local officials while withholding it from 
the general public. 

This designation has proven difficult for the executives to imple- 
ment, so difficult that in fact it went in a different direction and 
the mandate instead became to disperse information control au- 
thority across of broad range of executive agencies. This resulted 
in a disjointed and uncoordinated proliferation of sensitive but un- 
classified designations to protect poorly defined categories of infor- 
mation. 

In one instance, the Department of Homeland Security drafted a 
draconian nondisclosure agreement designed to apply the restric- 
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tions on tens of thousands of federal employees and hundreds of 
thousands, potentially, of state and local first responders. 

Although it was only enforced briefly, this NDA was more severe 
than NDA's effect for sensitive, compartmented information and for 
a variety of controls over the most sensitive intelligence informa- 
tion the government has. 

While it has been withdrawn, it is an indicator of the extent to 
which there has been little progress. 

Lastly, the National Intelligence Reform Act of 2004 provided an- 
other challenge which the administration found wanting. Congress 
provided a broad, centralized power for the new director of national 
intelligence and urged the new DNI to create a tearline report sys- 
tem by which intelligence gathered by an agency is prepared with 
the information relating to intelligence sources and methods is eas- 
ily severed but for the report to protect such sources and methods 
from disclosure. 

The prospect of such a tearline encouraged many observers to be- 
lieve the classification system could be improved by concentrating 
on the guidelines for protecting well-defined sources and methods. 
By making the refined decisions to protect that which truly re- 
quires protection, more of the remaining information would be 
available for sharing within the intelligence community, as well as 
with state and local officials charged with homeland security re- 
sponsibilities. They were naturally a benefit for the public and the 
press as this information, other information, was decontrolled. 

Ms. HARMAN. Mr. Armstrong, if you could summarize now, we 
would appreciate it. 

Mr. ARMSTRONG. Increasingly, officials in certain departments 
must greatly risk their security clearances and potentially their ca- 
reers and their family's financial security in order to correct and 
guide public-to-public record. 

It is my hope that rather than attempt to repair the present sys- 
tem of over-classification to the public, that the public, the news 
media, the Congress and the intelligence community would benefit 
more from the specification of rigorous and tight definitions of 
sources and methods in accord with the tear-line processing of in- 
telligence in order to maximize information sharing while pro- 
tecting the nation's secrets. 

Ms. HARMAN. Thank you very much. 

Ms. Fuchs? 

STATEMENT OF MEREDITH FUCHS, GENERAL COUNSEL, THE 
NATIONAL SECURITY ARCHIVE, GEORGE WASHINGTON 
UNIVERSITY 

Ms. FUCHS. Thank you. 

Chairman Harman, Ranking Member Reichert and members of 
the subcommittee, thank you for having me appear today. 

After the September 11th attacks on the United States, there 
were many signs that official secrecy would increase. Some of it 
was legitimate, out of concern about risks posed by poorly safe- 
guarded government information. In addition, in March 2002, 
White House Chief of Staff Andrew Card issued a directive to fed- 
eral agencies, requesting a review of all records and policies con- 
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cerning the protection of sensitive but unclassified information, 
also called SBU. 

This memorandum spurred agencies to increase controls on infor- 
mation. 

Mr. Leonard and Ms. Harman have already talked about the 
classification system and some of the statistics regarding that. I am 
going to focus on the SBU system where while we identified 28 dif- 
ferent information labeling standards and GAO identified 56, I 
have heard from the Office of the Program Manager of the informa- 
tion-sharing environment that they have identified at least 100 dif- 
ferent so-called safeguarding labels. 

There is no way to determine how many records are labeled with 
these safeguarding controls, because agencies do not track their use 
of these labels. 

When we issued our report a year ago, we identified a number 
of problems posed by these policies. Since that time, the Govern- 
ment Accountability Office and the program manager of the Infor- 
mation Sharing Environment themselves have expressed the same 
concerns. I am going to quickly list them, and my written testi- 
mony gives some additional detail. 

First, there is no monitoring of the use of safeguard labels. At 
many agencies, there are no limits on who can put a safeguard 
label on the information, and, indeed, at some agencies, that means 
hundreds of thousands of people are able to put these labels on. 
There is no time limit for how long the label lasts. Few agencies 
provide any procedure for the labels to be removed. Few agencies 
include restrictions that prohibit the use of labels for improper pur- 
poses, including to conceal embarrassing or illegal agency actions. 
Agencies have conflicting policies on the intersection of these labels 
and the Freedom of Information Act, but evidence certainly sug- 
gests that these labels are used to increase withholding of informa- 
tion. 

These labels likely increase the cost of information security, and 
there is no consistency among agencies about how to use these la- 
bels. So it seems likely that they inhibit information sharing. 

Focusing just on the three major concerns that my organization 
has, the absence of reporting mechanisms for sensitive but uncon- 
trolled markings makes any assessment of the extent to which a 
policy is being used difficult, if not impossible. 

Because safeguarding sensitive unclassified information impacts 
safety, security, budget and information disclosure, all of which are 
important national concerns, there ought to be some sort of over- 
arching monitoring. 

Second, in order to protect the important role that public access 
has played in government accountability, it is important that a sys- 
tem for challenging the use of these labels be established. 

Third, this unregulated use of safeguarding labels inhibits infor- 
mation sharing. Because the systems are sprawling in their scope 
and uncoordinated, they set up roadblocks for sharing. Lack of 
trust in the system likely leads to more classification, which also 
limits dissemination of the information. 

I would like to quickly touch on what progress has been made 
within the government. Mr. Leonard referred to this in his state- 
ment. As you know, Congress required the president to implement 
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and information-sharing environment with the Intelligence Reform 
and Terrorist Prevention Act of 2004. Pursuant to that, the Office 
of the Program Manager of the Information Sharing Environment 
was established to assist in the development of the environment. 

A report and implementation plan for the information-sharing 
environment was required within one year of enactment of the law. 
President Bush issued a memorandum on December 16, 2005 that 
set up this office, and specifically directed departments and agen- 
cies to standardized procedures for handling SBU. 

The resulting working group completed an inventory of designa- 
tions in March 2006, and there should have been a recommenda- 
tion for submission to the president by June 2006 on standardiza- 
tion of SBU procedures. Well, it is now March 2007, and, as far as 
I know, that hasn't happened. 

Part of the problem may be that these legislative mandates are 
imposed on an executive branch that does not want Congress to 
interfere and is not as concerned as I would hope about govern- 
ment accountability. And while I am reluctant to express that sort 
of a sentiment, the lack of willingness by the executive branch to 
respond is evidenced by the refusal of the Office of the Director of 
National Intelligence to participate in a March 2006 report by the 
Government Accountability Office about this very matter. 

In its report, GAO noted that the ODNI, the Office of the Direc- 
tor of National Intelligence, declined to comment on the draft, stat- 
ing that review of intelligence activities is beyond GAO's purview. 

I know that we are running short of time. I am going to just 
quickly raise three concerns about the process. I met, along with 
several other people, with Ambassador McNamara, who is now the 
program manager, and I was very impressed by him and the work 
that they have done, and I think that they have done a great anal- 
ysis. However, there is nothing in the process that suggests to me 
that we are quickly moving to standardization of SBU labels. 

While they have done an analysis, they were supposed to have 
submitted a recommendation to the White House in January 2007. 
That may have occurred. If it did, it hasn't been made public, and 
having public review of that is absolutely critical. 

Secondly, the program manager's effort is focused on information 
related to homeland security, law enforcement and terrorism, but 
this problem of SBU is far broader, and the category of information 
that affects our security is even broader than that. 

Placement of the program manager at the Office of the Director 
of National Intelligence possibly limits the likelihood that a govern- 
mentwide solution will be considered. 

And, finally, there just doesn't seem to be a schedule in place. 
They have collected and analyzed scores of information control poli- 
cies, they have many ideas about how to fix the problem, but they 
have been perpetually behind schedule. 

I am hopeful my testimony today has been helpful, and I am 
happy to take any questions. 

Thank you. 

[The statement of Ms. Fuchs follows:] 
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Prepared Statement of Meredith Fuchs 



March 22, 2007 



Chairwoman Harman, Ranking Member Reichert and Members of the Sub 
committee on Intelligence, Information Sharing, and Terrorism Risk Assessment, I 
am honored to appear before you today to talk about the growing problem of govern- 



I am testif ying on behalf of the National Security Archive (the "Archive"), a non- 
profit research institute and leading user of the Freedom of Information Act (FOIA). 
We publish a wide range of document sets, books, articles, and electronic briefing 
books, all of which are based on records obtained under the FOIA. In 1999, we won 
the prestigious George Polk journalism award for "piercing self serving veils of gov- 
ernment secrecy" and, in 2005, an Emmy award for outstanding news research. 

In my five years at the Archive, I have overseen five audita of federal agency 
FOIA processing. Most relevant to this hearing is the report we issued in March 
2006 entitled: "Pseudo-Secrets: A Freedom of Information Audit of the U.S. Govern- 
ment's Policies on Sensitive Unclassified Information." 

After the September 11, 2001, attacks on the United States, there were many 
signs that official secrecy would increase. The attacks themselves led to a wave of 
legitimate concern about the risks posed by poorly saf eguarded government informa- 
tion. Additionally, in March 2002 white House Chief of Staff Andrew H. Card issued 
a directive to federal agencies requesting a review of all records and policies con- 
cerning the protection of "sensitive but unclassified" information. This memorandum 
spurred agencies to increase controls on information. Further, during times of war 
or national crisis, the government's tendency to keep secrets always becomes more 
pronounced and pervasive. Thus, the U.S. entry into hostilities in Afghanistan and 
Iraq as part of the Global War on Terrorism necessarily led to an increase in the 
citation of secrets. 

The available statistics show that since the September 11 attacks on the United 
States, there has been a dramatic upsurge in government secrecy. Classification has 
multiplied, reaching 14.2 million classification decisions in 2005, nearly double the 
number in 2001. Officials throughout the militaiy and intelligence sectors have ad- 
mitted that much of this classification activity is unnecessary. Former Secretary of 
Defense Donald Rumsfeld acknowledged the problem in a 2005 Well Street Journml 
op ed: "I have long believed that too much material is classified across the federal 
government as a general rule. . . ." 1 The extent of over-classification is significant. 
Under repeated questioning from members of Congress at a hearing concerning 
over classification, Deputy Secretaiy of Defense for Counterintelligence and Security 
Carol A. Haave eventually conceded that approximately 50 percent of classification 
decisions are over-classifications. 2 These opinions echoed that of then-Chair of the 
House Permanent Select Committee on Intelligence Porter Goss, who told the 9/11 
Commission, "we overclassify very badly. There's a lot of gratuitous classification 
going on, and there are a variety of reasons for them." 3 

Alongside traditional classification are a plethora of new non statutory labels that 
are being applied to protect information that is deemed sensitive but unclassified. 
Some estimates count over 100 different so called "safeguarding" labels for records. 
There is no way to determine how many records are labeled with safeguarding con- 
trols, however, because agencies do not irack their use of these labels. 

At the same time that the indicators all started to point to increasing secrecy, the 
numerous investigations into the September 11 attacks on the United States each 
concluded that excessive secrecy interfered with the detection and prevention of the 
attacks. 4 Other reports, including one by the Government Accountability Office and 



1 Donald Rumsfeld, War of the Worlds, Wall St. J., July 18, 2005, atA12. 

2 Subcommittee on National Security, Emerging Threats and International Relations of the 
House Committee on Gov't Reform Hearing, 108th Cong. (2004) (testimony of Carol A. Haave), 
http^Anvw.fas,org/sgQ/can^ess/2004/082404transcript.paf; See id., (Testimony of J. William 
Leonard, Director of ISOO) ("It is my view that trie government classifies too much informa- 
tion."}. 

3 9/ii Commission Hearing, (Testimony of then Chair of the House Permanent Select Com- 
mittee on Intelligence Porter Goss) (2003), httpi//www.9-llcommission.gov/archive/hearing2/9- 
llCommission Hearing 2003-05-22.htmpnnel two. 

4 As the stafTiirector oTthe Congressional Joint Inquiry on 9/11 found, "[tlhe record suggests 
that, prior to September 11th, the U.S. intelligence and law enforcement communities were 
fighting a war against terrorism largely without the benefit of what some would call their most 
potent weapon in that effort: an alert and informed American public. One need look no further 
for proof of the latter point than the heroics of the passengers on Flight 93 or the quick action 
of the flight attendant who identified shoe bomber Richard Reid." Similarly, the entire 9/11 
Commission report includes only one finding that the attacks might have been prevented: 
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one by the successor body to the 9/11 Commission, have decried the delay in estab- 
lishing a workable information sharing environment. 6 

Against this background, the National Security Archive conducted an extensive 
audit of the actual policies used by agencies to "safeguard" information. 6 We filed 
targeted FOIA requests that identified information protection policies of 37 major 
agencies and components. We obtained and reviewed 28 distinct policies for protec- 
tion of sensitive unclassified information, many of which allow any employee in the 
agency to designate sensitive unclassified information for protection, but few that 
provide any procedure for the labels to be removed. Only a small number of policies 
included restrictions that prohibit the use of the labels for improper purposes, in- 
cluding to conceal embarrassing or illegal agency actions, or inefficiency. Further, 
and perhaps most troubling from a security perspective, was the remarkable lack 
of consistency among agencies as to how to use these labels. Most of the policies 
were vague, open-ended, or broadly applicable, thus raising concerns about informa- 
tion sharing, the impact of such designations on access to information, free speech, 
and citizen participation in governance. Given the wide variation of practices and 
procedures as well as some of their features, it is probable that these policies inter- 
fere with interagency information sharing, increase the cost of inf ormation security, 
and limit public access to vital infoimation. 

Further, we concluded that there are almost no incentives to control the use or 
misuse of these safeguarding labels. Unlike classified records or ordinary agency 
records subject to FOIA, there is no monitoring of or reporting on the use or impact 
of protective sensitive unclassified information markings. In comparison, it is useful 
to look to the formal classification system, which is governed by Executive Order 
12958, as amended, and is managed and monitored by the Information Security 
Oversight OHice (ISOO) at the National Archives and Records Administration 
(NARA). ISOO publishes an annual report to the President in which it quantifies 
the number of classification and declassifi cation decisions, the number of individuals 
with authority to classify material, and the type of information that is being classi- 
fied. Such reports enable the Executive Branch and Congress to monitor the costs 
and benefits of the classification system and to identify trends that may suggest the 
need to reform the system. 

The absence of reporting mechanisms for sensitive but unclassified control mark- 
ings makes any assessment of the extent to which a policy is being used difficult, 
if not impossible. Because safeguarding sensitive unclassified information impacts 
safety, security, budget and information disclosure all important national con- 
cerns some form of overarching monitoring of all information control would be val- 
uable. 

Nor is there a procedure for the public to challenge protective markings. For clas- 
sified information, the security classification system provides precise limits on the 
extent and duration of classification as well as a system for declassification, includ- 
ing public requests for declassification. For non security sensitive information, the 
FOIA provides a relatively clear and user friendly process for the public to seek ac- 
cess to information held by the government. Sensitive unclassified information, how- 
ever, falls into a black hole. Based on anecdotal information, we believe that infor- 
mation previously available under FOIA or on unrestricted Web sites may no longer 
be available to the public. Yet, there is virtually no opportunity for the public or 
other government personnel to challenge a decision to mark a document f or protec- 
tion as SBU, FOUO, or SSI. Accordingly, in order to protect the important role that 
public access has played in government accountability, it is important that a system 



at each agency or, alternatively, that FOIA procedures be adjusted to counteract the 
chilling effect these markings may have on disclosure under FOIA. 



"publicity about Moussaoui's arrest and a possible hijacking threat might have derailed the 
plot." Final Report of the National Commission on Terrorist Attacks Upon the United States, 
at 276 (emphasis added). 

5 In January 2005, the Government Accountability Office (GAO) added "Establishing Appro- 
priate and Effective Information-Sharing Mechanisms to Improve Homeland Security" to its 



as a government-wide nigh-risk area because this area, while receiving increased attention, still 
faces significant challenges" (GAO- 05-207). On December 5, 2005, the 9/11 Public Discourse 
Project, the successor body of the 9/11 Commission, issued its fc'inal Report on 9/11 Commission 
Recommendations. Important areas on information sharing, including "incentives for informa- 
tion sharing" and "government-wide information sharing," received a D in the scheme of letter 
grade assessments. 

6 The complete audit report is available at http:/ I www.gwu.edu I -nsarchiv/NSAEBB/ 
NSAEBB 183/press.htm. 
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Congress began to respond to these problems from the outset. Both the Homeland 
Security Act of 2002 and the Intelligence Reform and Terrorism Prevention Act of 
2004 (IRTPA) directed the development of policies for sharing classified and sen- 
sitive but unclassified information. IRTPA requires the rapid implementation of an 
information sharing environment (ISE) to facilitate the government-wide sharing of 
information about terrorist threats. As the subcommittee is aware, the oliice of the 
Program Manager of the ISE was established pursuant to IRPTA to assist, in con- 
sultation the Information Sharing Council (ISC), in the development of the ISE. A 
report and implementation plan for the ISE was required within one year of enact- 
ment of IRTPA. President Bush issued a Memorandum on December 16, 2005, di- 
recting federal departments and agencies to standardize procedures for handling 
SBU information. 

The President's December 2005 Memorandum setting up the office of the Program 
Manager contained specific direction related to the standardization of Sensitive But 
Unclassified (SBU) information, Specifically, Guideline 3 required each department 
and agency to inventoiy existing SBU procedures and their underlying authorities 
across the Federal government, and to assess the effectiveness of these procedures 
and provide this inventory and assessment to the Director of National Intelligence 
(DNI) for transmission to the Secretary of Homeland Security and the Attorney 
General. The working group completed an initial inventory of SBU designations in 
March 2006. The original schedule would have resulted in recommendations for sub- 
mission to the President regarding the standardization of SBU procedures by June 
2006. More than 5 years after the September 11 attacks, however, there still is no 
government wide plan to standardize information controls and ensure government 
accountability. 

Part of the problem may be that these legislative mandates are being imposed on 
an executive branch that does not appreciate Congressional interference and does 
not seem concerned about government accountability. I am reluctant to express such 
strong sentiments, but the lack of willingness by the Executive Branch to respond 
to Congress's mandates is strongly evidenced by the refusal of the Office of the Di- 
rector of National Intelligence to participate in a March 2006 report by the Govern- 
ment Accountability Office about this very matter. In its report, GAO noted that the 
ODNI "declined to comment on [GAO's] draft report, stating that review of intel- 
ligence activities is beyond GAO's purview." 

Further, the responsibility for overseeing the development of a comprehensive 
plan has been shifted from office to office; it was first lodged at the Office of Man- 
agement and Budget, then at the Department of Homeland Security and now in the 
Office of the Director of National Intelligence. Thus, despite the urgent need to bet- 
ter coordinate information sharing, it has taken some time for the program to find 
a home. Whether the ODNI is the proper home remains to be seen, especially in 
light of that office's unwillingness to be subjected to congressional scrutiny. Another 
delay was caused by the quick departure of the first Program Manager for the Infor- 
mation Sharing Environment (ISE) in January 2006. He was replaced by Ambas- 
sador Thomas McNamara. 

I had the opportunity, along with several other open government advocates, to 
meet with Ambassador McNamara on November 20, 2006, Ambassador McNamara 
described for our group the challenges that the office of the Program Manager is 
facing in rationalizing the system for safeguarding records. They must obtain the 



and consider the concerns of both governmental and non governmental entities. To 
date, they have only analyzed the problem. The November 16, 2006, Report of the 
Program Manager, Information Snaring Environment, indicates that the inter- 
agency Information Sharing Council (ISC) created to develop an implementation 
plan for the ISE, along with standardizing procedures for sensitive but unclassified 
information, has now created a Coordinating Committee which will submit rec- 
ommendations for SBU standardization through the White House policy process. We 
were told that a recommendation would be transmitted to the White House in Janu- 
ary 2007, but I am not aware whether this has happened or whether the rec . 
ommendation will ever be made public. 

For my own part, I was impressed with Ambassador McNamara's work to date, 
but I was not left with any strong impression that a transparent, government wide 
information sharing plan will emerge any time soon. First, there are many steps in 
the process that do not yet appear to have taken place. A recommendation has yet 
to be circulated for review by interested parties. Any recommendations should be 
made available to the public for comment. Even the general outline of a program, 
which was previewed to me and others in November 2006, raised several concerns 
about transparency, government accountability, and appropriate procedures. Once a 
recommendation is accepted, then an implementation plan will be necessary. It is 
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possible that there will need to be statutory or regulatory changes to facilitate im- 
plementation. There certainly will be budgetary issues raised by any recommenda- 
tion and plan for standardization. 

Second, the focus of the Program Manager's effort is solely on information related 
to homeland security, law enforcement and terrorism. The problem of sensitive un- 
classified information is far broader, and even the category of information that af- 
fects our security is likely more extensive than is covered by the Program Manager's 
mandate. Placement of the Program Manager at the ODNI further limits the likeli- 
hood that a government wide solution will be considered or emerge as an outgrowth 
of the process. Because of the placement within the ODNI, the program manager 
is likely to face great challenges in implementing an information sharing network 
that includes agencies outside the intelligence community. Issues of information se- 
curity, information sharing, and public access to information should not be ad- 
dressed in a piecemeal manner. There are best practices in some agencies that 
should be shared, as well as lessons to be learned about the costs and benefits of 
secrecy and disclosure. If the problem of information controls interfering with infor- 
mation sharing is ever to be solved, it will require a government wide commitment. 

Third, there does not appear to be any schedule in place for moving the process 
forward. The fact that the Program Manager has collected and analyzed scores of 
information control policies is progress. That analysis surely offers insight into what 
works and what does not. Now the analysis must be translated into a plan with 
strict deadlines and funding in order to make implementation a reality. Given that 
the project has been perpetually behind schedule, there is cause for concern about 
the development of an actionable plan and implementation. 

Unnecessary secrecy has been on the rise since September 11, with the result of 
threatening our safety and national security while impeding the process of democ- 
racy and the effective functioning of government. There is no time for turf wars or 
bui-eaucratic inertia. We ai^e long overdue for solving the challenges of information 
sharing and overcoming the strain on government accountability brought about by 
excessive secrecy. SBU designations have been noted by government authorities as 
a major impediment to information sharing, yet no solution to the problem has been 
developed. I am hopeful that my testimony today offers a rationale and a sense of 
urgency for instituting stronger measures to encourage needed reforms in informa- 
tion control programs across the federal government. I am grateful for your interest 
in these issues and am happy to respond to any questions. 

Ms. HARMAN. I thank the three witnesses. Your testimony is very 
helpful. 

And, Mr. Leonard, nobody doubts your good faith and hard work, 
but I do question whether we are making much progress rolling a 
big rock up a steep hill. 

Let me start there. As I said, I spent 8 years on the House Intel- 
ligence Committee, and I spent many years on virtually every secu- 
rity committee in this House since being elected in 1992. I do re- 
spect the need to protect sources and methods. I have never, so far 
as I know, ever compromised a source or a method, and I under- 
stand that real people die if that happens, and we close down our 
ability to get sensitive information in the future, so we should 
never do that. 

But that is the purpose of our classification system. The purpose 
of our classification system is not to deprive the public of informa- 
tion it should have, and, surely, it is not to deprive our first pre- 
venters on the ground of information they need to know what to 
look for and what to do. 

Does anyone disagree with what I just said? 

Mr. Leonard. Absolutely not, Madam Chair. 

Ms. HARMAN. I am sure you don't. 

I also share Ms. Fuchs's opinion of Ambassador Ted McNamara, 
with whom I have met. His title is program manager, Information 
Sharing Environment, and he reports to the director of national in- 
telligence, Mike McConnell. He is a good man, and he is trying to 
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shift a lot of information out of the classification system into this 
SBU system. 

But, again, I am worried that we are just going to replace one 
protection system with another protection system. 

Does anyone disagree with that thought? 

No. Okay. Well, now I am really getting discouraged. 

So where do I come out? I am intrigued by Mr. Armstrong's sug- 
gestion at the conclusion of his testimony — and I know I was rush- 
ing you, but I am trying to be fair all our members and here and 
to our second panel. I think what you said is, we need to start over. 
We can't take this jerry-rig system and fix it. It is too complicated, 
and we aren't going to fix it, we are just going to move the boxes 
around. We really ought to think through what our goals and objec- 
tives are and start over. 

Is that what you said? 

Mr. ARMSTRONG. Precisely. That is the lesson of 50 years of na- 
tional security controls, 35 years since the Pentagon Papers, 34 
years since Watergate and 22 years, 25 years of these three com- 
missions that have ensued. All have come back to the same thing: 
If we want to protect important information, we must identify it, 
isolate it, understand why it needs to be protected and commu- 
nicate that to government employees. They will respect it, the press 
will respect it, in turn, and you will not have dangerous leaks of 
national security information. 

You will also have an enormous amount of information that is 
not contained in those categories that will freely available for pub- 
lic policy debate and discussion. That is what we need. 

Ms. HARMAN. Well, let me ask the other two witnesses to re- 
spond to this innovative and, I think, potentially visionary sugges- 
tion. I am not sure we are up to this, but I just want to ask what 
you think about it. It is basically to start over, to identify what we 
need to protect. 

And, as I heard you, Mr. Armstrong, you were saying if we do 
this right, then we actually discourage and stop leaks because in- 
formation that should be in the public domain gets there, and we 
should presume we have patriots in our press corps who work for 
government, who serve in Congress and elsewhere who will protect 
secrets that they understand clearly need to be protected. 

So my question, let's start with you, Mr. Leonard, is, what do you 
think about this idea of starting over to isolate what truly needs 
to be protected? 

Mr. Leonard. Well, clearly, the challenge of over-classification, 
as I included in my prepared testimony. As long ago as the 1950s, 
the Wright commission, established by Congress at the height of 
the Cold War, found that over-classification was a threat to na- 
tional security. 

The largest problem, as I see, with the current framework is that 
it is tilted toward encouraging people to withhold. Everyone is very 
mindful of the fact that they can be disciplined, fired, maybe even 
criminally prosecuted for unauthorized disclosure. Even though the 
policy makes an affirmative — at least the classification imposes an 
affirmative responsibility on cleared individuals to challenge inap- 
propriate classifications, quite frankly, I am never aware of that 
ever happening. 



VerDateNov24 20O8 15:42 Jun 07,2009 Jkt 000000 PO 00000 Frm 00022 Fmt6633 Sfmt6601 H:\DOCS\110-HRGS\110 20\35279.TXT HSEC PsN: DIANE 



19 



And, to me, it is the flipside of the coin: Yes, we have to hold 
people accountable for inappropriate disclosures, but unless we 
similarly have a system to hold people accountable for inappro- 
priate withholding or hoarding of information, the system will re- 
main dysfunctional. 

Ms. HARMAN. Thank you very much. 

My time is expiring, so, Ms. Fuchs, if you have any comments, 
please make them now. 

Ms. FuCHS. Right. I mean, I would second what Mr. Leonard 
said. I think that the secrecy is a reflexive response by people with- 
in the government, and it is going to be hard to fight that. There 
should be better training, and the incentives have to be changed. 
And the incentives are changed, I think, by doing oversight, having 
audits of secrecy decision making, making legal remedies available 
to the public, having whistleblower protection and having leader- 
ship on the issue. 

Ms. HARMAN. Thank you very much. 

The chair now recognizes Mr. Reichert for 5 minutes. 

Mr. Reichert. Thank you, Madam Chair, and, again, thank you 
for being here this morning. 

Mr. Leonard, you made a statement, I think it was you, that said 
that trained people only get it right 64 percent of the time. Why 
is that? 

Mr. Leonard. It harkens back to the point I just made, Mr. 
Reichert. I was in a similar forum with a very senior official from 
the Defense Department once and she indicated, I think, a very 
prevalent line of thought, and that is, especially in time of war, 
people want to err on the side of caution. 

And I am dumfounded by that approach, because, first of all, I 
never understand why we want to have error as part of any imple- 
mentation strategy. But besides that, if we are ever going to get 
it right, to me, in time of war is the time we have to get it right. 

As Ms. Fuchs says, we have to change the incentives and have 
people recognize that the inappropriate withholding or hoarding of 
information can have just as much as a deleterious impact on the 
national security as any unauthorized disclosure can. 

Mr. Reichert. Mr. Armstrong, would you say that that is true? 
In your statement, you mentioned sensitive homeland security in- 
formation for state and locals don't get to the state and locals. Is 
that part of the problem that Mr. Leonard is talking about? 

Mr. ARMSTRONG. I believe it is. I think there are two reasons. 
One is the bureaucratic default to caution, that it is easier to con- 
trol than it is to release. But, secondly, control has its own value 
and purpose. It allows a manipulation of the debate. It prevents 
people from having a more open and participatory discussion about 
the allocation of resources, about priorities. 

We heard in the dialogue from the Department of Homeland Se- 
curity at one point that they were considering the prosecution or 
restraint on journalists publishing information about chlorine 
plants and their danger in metropolitan areas. Now, the plant 
doesn't become more dangerous because there is a publication of it. 
It is possible that some terrorist might learn that there is some- 
thing there that they could blow up, but it is unlikely that they 
haven't already identified it. 
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What happens is the public learns about it, and as that informa- 
tion is openly discussed, precautions are taken, political actors are 
held accountable, and those political actors who become decisions 
makers during crisis begin to take appropriate action. 

Mr. REICHERT. Now, for all three of you, there has been — Mr. 
Armstrong, you especially mentioned that you have been involved 
in discussions with just about every member of the intelligence 
community. I didn't hear you say that state and local agencies were 
involved in discussions that you were having. Did I incorrectly — 

Mr. ARMSTRONG. No, that is correct. Our primary purpose was 
when the equivalent of an Official Secrets Act was passed in the 
year 2000 and the vetoed and then came up again the following 
year, we wanted to learn, in the press, we wanted to learn what 
the concern was in the federal government and how we might best 
meet that. But we have not had that discussion at the local level. 

Mr. REICHERT. For all three of you, quickly, state or local public 
disclosure laws, have you been trying to connect with state officials 
and local officials to find out how to work through that problem? 

Ms. FucHS. If I could respond, I wanted to mention(it is a big 
problem what happens at the state and local level, and there is 
going to have to be some coordination. I wanted to draw the sub- 
committee's attention to a report that was done by the American 
Society of Newspaper Editors that was released last week where 
they did an audit where they went to state and local offices to get 
copies of the Comprehensive Emergency Response Plan in each of 
those places. 

That is something that is mandated to be made public by the 
Emergency Planning and Community Right to Know Act of 1986, 
and it is something that, for instance, tells you escape routes that 
the public should be aware of if something happens in their com- 
munity. 

More than a third of the public officials refused to provide the 
report. It is sort of the opposite of — a variation on the story that 
you told, Mr. Reichert at the outset 

Mr. Reichert. Yes. 

Ms. FucHS. — about not sharing information. 

But it is the kind of thing, for instance, I know that in D.C. that 
K Street divides which way you get out of the city if something 
happens. Well, I work on one side of K Street and my kid goes to 
school on the other side of K Street. Knowing that information is 
important to me as a member of the public. 

Mr. Reichert. Yes. I would make one last point. We can come 
up, devise the greatest system in the world, which we don't have 
right now, obviously, but if we start over, it could hopefully end up 
being better, but the system is made up of people, and that is going 
to be our major problem. 

I know on a number of occasions in my 33 years in the sheriffs 
office we were going to serve a search warrant and I showed up at 
an address to serve a search warrant on a suspect in that major 
serial case I was talking about earlier only to find a reporter stand- 
ing on the front porch waiting for me. So we can build a great sys- 
tem, but it all boils down to the people and the responsibility that 
they take. 

Thank you. I yield. 
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Ms. HARMAN. I thank the ranking member for yielding. 

The chair now recognizes Mr. Langevin for 5 minutes. 

Mr. Langevin. Thank you, Madam Chair. 

I want to thank our witnesses for testifying here today. 

Can you just walk me through the process of how people get ac- 
cess to this sensitive but unclassified information? Does this come 
down to the fact that we needed better information-sharing envi- 
ronment among people like law enforcement, and one of the things 
I know that DHS is struggling through right now is creating an in- 
formation-sharing environment for terrorism-related issues, similar 
to the type of information sharing that law enforcement — that type 
of a system that law enforcement has right now. 

For example, in New England, we have RISNet, Regional Infor- 
mation Sharing Network, so that information on law enforcement 
issues can get out there to those that need it. DHS is struggling 
with creating that kind of a system. I think Charles Allen at DHS 
is doing a very good job of moving in the right direction, but we 
are certainly not there yet. 

So is that the model that we have right now? I just want to get 
an understanding of when something is sensitive but unclassified, 
can anybody in the law enforcement realm — you know, is that in 
the need-to-know category? 

Mr. Leonard. Although not in my official realm of responsibil- 
ities, I can address that and that is the bottom line. The challenge 
is, there is no one model. With over 100 types of systems, I dare 
say there is no one individual in the entire federal bureaucracy 
who knows how to leverage access to all these types of controlled 
information. 

And the challenge then, of course, is, when agencies want to le- 
verage technology to help disseminate this information, and there 
are all different types of controls and constraints on it, you are 
somewhat restricted in terms of what you can put into a technology 
system if you don't know the rules for handling and disseminating 
and access, because there currently are no systems. And this is 
what Ambassador McNamara's office is in fact trying to address. 

Mr. Armstrong. One issue you might consider, congressman, is 
the fact that the Department of Homeland Security does not seem 
to have a risk assessment matrix that allows them to put value on 
particular information and figure out what it is they are trying to 
control and from whom. 

When they issued, in 2004, a nondisclosure agreement, which I 
included a copy of, attached to my statement, they included the 
long list of things and then the words, "and other identifier used 
by other government agencies to categorize information as sensitive 
but unclassified," and gave authority to any supervisor to create 
any such category. So people have millions of different interpreta- 
tions. 

It requires leadership, it requires some identification of what the 
dangers are and what the purpose of controlling information is. If 
they can't identify that, don't control it. 

Mr. Langevin. Let's kind of elaborate on that, if we could, a little 
more. How might we go about creating a standardized system for 
sharing sensitive but unclassified information? And would a stand- 
ard approach be a net positive? And furthermore, to what extent 
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do you think there will be any resistance to such an effort and from 
whom? 

Ms. FuCHS. Well, I think that standardizing would be a benefit. 
I mean, we see it in the classification system, there is some regu- 
larity, there are reporting requirements, there is way to challenge 
classification decisions. It may not happen that often, but at least 
there is some transparency to the system and there is some control. 

What is happening in the SBU system is it is all over the place, 
and the absence of any type of regulation means that it is an inter- 
ference with information sharing. 

But I want to also add that part of making information sharing 
work means including the public in information sharing, because 
the public has just as much concern as the government in pro- 
tecting ourselves. 

I mean, we all know the story of the sniper in Washington, D.C. 
It was only because the license plate on that car got out and a 
trucker who stopped at the side of the street saw the car and re- 
ported it. The public has a role to play as well, so any kind of sys- 
tem should consider the importance of sharing information with 
the public. 

Mr. Leonard. And being a lifelong bureaucrat, I find rules can 
be empowering as well. Because, right now, with the mass confu- 
sion, people on the frontlines and the federal bureaucracy who have 
to make decisions, there is such confusion that the default is, well, 
I don't know if I am going to default. 

If we have clearly articulated rules, that can be empowering as 
well, because then it removes the uncertainty in people's minds. 
They know exactly what they can disclose, under what cir- 
cumstances and who. And also then if people want to challenge 
those controls, we know what it is we are challenging. 

Mr. ARMSTRONG. I think the standardization needs to be of the 
risk assessment process and of the process of engaging the partners 
with whom you want to share information. If you build it, they will 
come, but it has to be truly understood, as Meredith mentioned, 
those partners include the public. The chlorine plant situation, peo- 
ple who own chlorine plants do not want information distributed 
about them, particularly when there are risks from them. 

Ms. HARMAN. The time of the gentleman has expired. 

The chair now recognizes the very patient Mr. Dent of Pennsyl- 
vania for 5 minutes. 

Mr. Dent. Thank you, Madam Chairman. 

Mr. Leonard, the president directed that the designation of sen- 
sitive but unclassifi ed information be standardized. In response, an 
interagency working group, led by DHS, DO J and the program 
manager for the Information Sharing Environment, initiated an ef- 
fort to address these issues. I understand that your office is part 
of that effort and that the working group has submitted rec- 
ommendations to the president regarding the standardization of 
sensitive but unclassified procedures. 

When do you expect these recommendations to be approved by 
the president? And what outstanding issues are there? 

Mr. Leonard. Sure. 

Congressman I serve as an advisor to the working group that 
Ambassador McNamara heads up. Being an observer and an advi- 
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sor to that group, I can attest that significance progress has been 
made. Those recommendations actually have not yet been passed 
up to the president as of yet, but my understanding is that the 
timeline is a matter of months of get it through the process. 

Mr. Dent. To get it to the president. 

Mr. Leonard. To get it to the president; yes, sir. 

Mr. DENT. Okay. Then what can we do to assist you through this 
process? I mean, what can Congress do? 

Mr. LEONARD. Well, one of the challenges that I have always took 
note of is that many of the controls that agencies have placed on 
unclassified information are actually based in statute. And one of 
my observations has been is that each and every time we create 
one of these new homegrown controlled items, that we seem to do 
it from scratch and we don't pay homage to what has gone before. 

And I believe whenever Congress makes the observation that cer- 
tain types of information needs to be controlled from a statutory 
point oi view, that to whatever extent including in those mandates 
is the need to ensure that it is being done in a consistent manner, 
I think would be highly effective. 

Mr. Dent. More specifically, Mr. Leonard, I know you testified 
before that the classification authority is pursuant to the presi- 
dent's article 2 authorities under the Constitution, and that cer- 
tainly complicates these legislative remedies. 

So, I guess, what, in your opinion, would a legislative remedy to 
the problem of over-classification and pseudo-classification look 
like? 

Mr. LEONARD. Well, my reference to the president's article 2 au- 
thority, of course, is with respect to the classification for a national 
security information system, which I oversee. The pseudo-classifica- 
tion system, as I said, that has its origins in a number of different 
areas. 

Anything that we can do to change — the observation was made 
about ultimately it is people who make the system works, and any- 
thing that we can do to encourage people to recognize the need that 
inappropriate withholding of information is similarly deleterious 
and change that culture is, I think, ultimately what is required in 
this area. 

Mr. Dent. Thank you. 

And, finally, in August of 2004, you testified, essentially, that the 
creation of a director of national intelligence would be a good thing 
if the DNI could overcome all of the nuances in the classification 
system. 

Has this been the case, or does the DNI need more authorities 
to iron out the classification system, in your opinion? 

Mr. LEONARD. The DNI has taken a leading role, from my obser- 
vation, in terms of trying to establish greater consistency with re- 
spect to how the intelligence sources, methods and activities are 
handled across the board. That is obviously a work in progress, but 
my observation is that the DNI has taken a much' needed leader- 
ship role in this area. 

Mr. DENT. Thanks, Madam Chairman. I yield back. 

Ms. HARMAN. I thank the gentleman. 

As this panel exits, I would just like to note that I was one of 
the godmothers for the creation of the Department of Homeland Se- 
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curity, and I was a coauthor of the legislation establishing the Of- 
fice of the Director of National Intelligence, and our clear intent, 
on a bipartisan basis, was to simplify, not complicate, this system. 

So I am hopeful that this subcommittee, on a bipartisan basis, 
will take up Mr. Armstrong's challenge and see if we can accom- 
plish that goal, which is a lot later than we intended but very time- 
ly. 

The first panel is excused, and as the second panel comes up, I 
would note that we are expecting votes between 11:15 and 11:30. 
Mr. Reichert and I want to hear from both witnesses and ask our 
questions very promptly, because we don't want you to have to stay 
around for the half hour or more that we will have to recess. 

Thank the witnesses very much. 

Okay. Let's have the second panel takes your seats. Even with- 
out nametags, we know who you are. 

Our first witness, Cathy Lanier, is the chief of the Metropolitan 
Police Department here in Washington, D.C. She was named police 
chief by D.C. Mayor Adrian Fenty and assumed her position on 
January 2nd of this year. Before her appointment, she was tapped 
to be the first commanding officer for the police department's Office 
of Homeland Security and Counterterrorism, which was established 
in 2006. 

A highly respected professional in the areas of homeland security 
and community policing, Chief Lanier took the lead role in devel- 
oping and implementing coordinated counterterrorism strategies 
for all units within the Metropolitan Police Department and 
launched Operation TIPP, which is D.C.'s Terrorist Incident and 
Prevention Program. 

Our second witness, Michael Downing, serves as the assistant 
commanding officer, Counterterrorism Criminal Intelligence Bu- 
reau, where he assists two regional operations, which command the 
Los Angeles Joint Regional Intelligence Center, called the JRIC. 

And we welcome him from L.A. 

I will skip all the rest of his wonderful credentials, because we 
want to get right to your testimony. 

And, without objection, the witnesses' full statements will be in- 
serted in the record. 

I now ask each witness to summarize as quickly as possible, 
starting with Chief Lanier. 

STATEMENT OF CHIEF CATHY L. LANIER, METROPOLITAN 
POLICE DEPARTMENT, WASHINGTON, D.C. 

Chief Lanier. Thank you. Good morning. 

Chairman Harman, members of the committee, staff and guests, 
thank you for this opportunity to present this statement on the im- 
pact of over-classification on information sharing. 

To begin, I emphasize the important role that local law enforce- 
ment plays in homeland security efforts. We are more than merely 
first responders, as you have stated. We are first preventers who 
are uniquely positioned to detect and prevent terrorist incidents 
right here in our home. There are 800,000 law enforcement mem- 
bers across the nation who know the communities they serve and 
are in the best position to detect the investigative criminal activity 
that might be connected to terrorism. 
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Information provided by local police, if discovered early and 
matched with the right intelligence, can help detect, disrupt and 
prevent a terrorist plot. However, in order for local law enforce- 
ment to perform its critical role of first preventer, it is essential 
that the police officers and support personnel be provided with 
timely intelligence information. This requires an intelligence con- 
duit consisting of an organized, effective and trusting flow of infor- 
mation between local law enforcement and our federal partners. 

It is important to note that in the national capital region, the 
flow of information among our federal partners is fairly good 
through the JTTF. Part of that reason for that is that our agencies 
have worked together for years sharing information and coordi- 
nating responses to a variety of situations. Pre-established relation- 
ships and a track record of trust has made smooth and eliminated 
obstacles experienced by other jurisdictions. The JTTF understands 
local law enforcement and appreciates the value of those relation- 
ships. 

Nonetheless, several issues remain as it relates to federal and 
local information sharing. Law enforcement needs better access to 
federal intelligence information as well as an enhanced ability to 
translate such information into local law enforcement activity. This 
involves classifying information appropriately as well as creating a 
more efficient local access, both classified and non-classified infor- 
mation. 

Access to federal intelligence information remains a major obsta- 
cle for local law enforcement. While the security classification sys- 
tem that mandates security clearances helps to ensure that sen- 
sitive information is protected, it also hinders the local homeland 
security efforts. 

Information collected by the federal government is sometimes 
overly classified and causes valuable information that should be 
shared to remain concealed. Law enforcement does not need to 
know the details about where information originates or how it is 
collected; however, we do need sufficient and timely information in 
order to know what to look out for as well as what scenarios to pre- 
pare for. 

Information provided by the federal government that is dated or 
only shared once the threat becomes imminent does not offer value 
to local law enforcement. At this point, it is too late for us to en- 
hance our capabilities to effectively deal with a threat. Conversely, 
local law enforcement analysts should also ensure that intelligence 
they collect is assessed and shared with DHS, FBI and other local 
and state agencies. 

The significant challenges facing local law enforcement is in 
translating this intelligence once it is obtained from the federal 
government into actions for local jurisdictions. This challenge is no- 
tably exacerbated when the information provided is either not 
timely or is restricted so that it cannot be shared with other stake- 
holders. 

It is critical that the local law enforcement community be made 
aware of global trends regarding people and organizations that 
have a potential to commit crimes or pose a bona fide threat to our 
community. Awareness of these global trends will identify emerg- 
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ing threats and allow me to properly train my patrol officers on the 
individual elements needed to mitigate these emerging threats. 

As a police chief, I need various forms of intelligence that will 
come from a variety of different agencies. On the strategic side, I 
need a global view of known terrorist organizations, groups and in- 
dividuals, both foreign and domestic, and the potential threat they 
may post to the homeland. This type of intelligence provides me 
with a better understanding of the history of these groups, their ca- 
pabilities and their interest in particular targets or weapons. 

The broad nature of this type of intelligence, in my opinion, 
should not be classified beyond law enforcement sensitive. Even 
when it involves emerging groups and capabilities, as long as the 
information remains in the law enforcement community and is 
used for legitimate law enforcement purposes, it should not cause 
harm to any ongoing intelligence operation. 

In addition to increased awareness of global trends, I also need 
to be familiar with the local threat environment right here in the 
national capital region. Being familiar with the presence of known 
terrorist organizations in this region allows me to educate and 
train my officers on the known tactics used by these organizations 
so they can pay particular attention to the certain subtle activities 
while on routine patrol. 

For example, if it is known that a particular terrorist organiza- 
tion that has a presence in the NCR is known to engage in financ- 
ing terrorist activities by selling unpacked cigarettes, my patrol of- 
ficers need to be aware of this so that particular tactic — so they 
would know which information needs to be shared with the JTTF 
for further analysis. 

This intelligence, combined with information such as how these 
groups travel, communicate and influence will help me influence 
the resource allocation, training, prevention efforts and response 
practices. 

The bottom line, the frontline officers who see individual ele- 
ments of crimes every day need to be knowledgeable of emerging 
threats and tactics in order to link these individual elements so 
that trends can be identified early and mitigated quickly. 

I will skip to the end of my testimony to stay within the time, 
but I do believe that ultimately improvements in the intelligence- 
sharing environment will make our nation safer, as the federal gov- 
ernment and local first responders work jointly as first preventers. 

And I thank you for having this opportunity today. 

[The statement of Chief Lanier follows:] 

Prepared Statement of Cathy L. Lanier 
March 22, 2007 

Chairwoman Harman, members of the Committee, staff and guests — thank you 
for the opportunity to present this statement on the impact of. overclassification on 
information sharing. Specifically, I will address federal level information sharing 
with local law enforcement. 

To begin, I emphasize the important role that local law enforcement plays in 
homeland security efforts. We are more than merely first responders. We are first 
preventers who are uniquely positioned to detect and prevent terrorist incidents 
right here at home. There are 800,000 law enforcement members across the nation 
who know the communities they serve and are in the best position to detect and 
investigate criminal activity that might be connected to terrorism. Information pro 
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vided by local police if discovered early and matched with the right intelligence 
can help detect, disrupt and prevent a terrorist plot. 

However, in order for local law enforcement to perform its critical role of first pre- 
venter, it is essential that police officers and support personnel be provided with 
timely intelligence information. This requires an intelligence conduit consisting of 
an organized, effective and trusting flow of information between local law enforce- 
ment and our federal partners. It is important to note that in the national capital 
region, the flow of information among federal, state and local partners through our 
Joint Terrorism Task Force (JTTF) is quite good. Part of the reason for this is that 
our agencies have worked together for years sharing information and coordinating 
responses to a variety of situations. Pre established relationships and a track record 
of trust have smoothed many of the obstacles experienced by other jurisdictions. The 
JTTFs understand local law enforcement, and appreciates the value of local rela- 
tionships. I believe other aspects of the federal homeland security community could 
learn from the experiences of the JTTFs. 

Nonetheless, several issues remain as it relates to federal local intelligence shar- 
ing practices. Local law enforcement needs better access to federal intelligence infor- 
mation, as well as an enhanced ability to translate such information into local law 
enforcement activity. This involves classifying information appropriately, as well as 
creating moire efficient local access to both non classified and classified information. 
Further, we need to recognize the importance of smaller law enforcement agencies, 
as well as the need to expand homeland security efforts beyond our traditional part- 
ners. I will discuss these issues in greater detail in this testimony. 

Access to federal intelligence information remains a major obstacle for local law 
enforcement. While the security classification system that mandates security clear- 
ances helps to ensure that sensitive information is protected, it also hinders local 
homeland security efforts. Information collected by the federal government is some- 
times overly classified, causing valuable information that should be shared to re- 
main concealed. 

Local law enforcement does not need to know details about where information 
originates or how it was collected. However, we do need sufficient and timely infor- 
mation in order to know what to look out for as well what scenarios to prepare 
and drill for. Intelligence analysts should assess intelligence information and syn- 



local law enforcement personnel. This requires that they write the analysis for re- 
lease and appreciate the type of actionable information useful to law enforcement. 
I want to also emphasize the importance of quickly sharing information even if the 
information is not fully vetted. Information provided by the federal government that 
is dated or only shared once a threat becomes imminent does not offer value to local 
law enforcement. At this point it is too late for us to enhance our capabilities to 
effectively deal with the threat. Conversely, local law enforcement analysts should 
also ensure that intelligence they collect is assessed and shared with DHS, FBI, and 
other local and state agencies. 

A significant challenge facing local law enforcement is translating the intelligence 
information that is obtained from the federal government into action for local juris- 
dictions. This challenge is notably exacerbated when the information provided either 
not timely or is restricted and cannot be shared with other stakeholders. It does a 
local police chief little good to receive information including classified informa- 
tion about a threat if she cannot use it to help prevent an attack. Operationally, 
local law enforcement needs to be aware of the presence of possible terrorist organi- 
zation activity in their jurisdiction and surrounding region. This intelligence com- 
bined with information such as how these groups travel and communicate influ- 
ence local law enforcement resource allocation, training, prevention, and response 
practices. 

It is critical that the local law enforcement community be made aware of global 
trends regarding people and organizations that have the potential to commit crimes 
or pose a bona fide threat to the community. Awareness of these global trends will 
identify emerging threats and allow me to properly train my patrol officers on the 
individual elements needed to mitigate these emerging threats. As a police chief I 
need various forms of intelligence that will come from a variety of different agencies. 
On the strategic side, I need a global view of known terrorist organizations, groups 
and individuals both foreign and domestic and the potential threat they may pose 
to the homeland. This type of intelligence provides me with a better understanding 



gets or weapons. The broad nature of this type of intelligence, in my opinion, should 
not be classified beyond "law enforcement sensitive". Even when it involves emerg- 
ing groups or capabilities, as long as the information remains in the law enforce 
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ment community, and is used for legitimate law enforcement purposes, it should not 
cause harm to any ongoing intelligence operation. 

In addition to increased awareness of global trends, I also need to be familiar with 
the local threat environment in the national capitol region. Being familiar with the 
presence of known terrorist groups in the region allows me to educate and train my 
officers on the known tactics used by these organizations so they can pay particular 
attention to certain subtle activities while on routine patrol. For example, if it is 
a known that a particular terrorist group that has a presence in the NCR is known 
to engage in financing terrorist activities by selling untaxed cigarettes, my patrol 
officers need to be aware of these and other tactics so that they would know which 
information to pass to the JTTF for further analysis. 

The bottom line issue is that the frontline officers, who see the individual ele- 
ments of crimes, need to be knowledgeable of emerging threats and tactics in order 
to link these individual elements so that trends can be identified early and miti- 
gated quickly. 

Importantly, there are also occasions where local law enforcement officials may 
need to be apprised of classified information. There is no question that local law en- 
forcement personnel have added value to federal task forces — -such as the JTTFs — 
as well as Department of Homeland Security operation centers. It is for these rea- 
sons that appropriate security clearances must be granted in a timely manner— 
to local police. 

While the Metropolitan Police Department (MPD) has obtained a number of secu- 
rity clearances for its members, that is not true for all law enforcement organiza- 
tions. It is imperative that federal, state, and local law enforcement personnel that 
are working together to protect the nation from terrorist threats be on equal footing. 
While local law enforcement has seen some improvement in the process of receiving 
security clearances, more must be done to expedite the process. 

I am optimistic that the DHS supported fusion centers that are becoming oper- 
ational across the country will help bridge some the existing intelligence sharing 
gaps. This will be accomplished by having analysts from different agencies and per- 
spectives talking to each other and working together. . 

While large sized police departments have the ability to develop and implement 
more sophisticated intelligence functions, small agencies are sometimes left out of 
the loop. In the Washington area alone there are 21 municipal law enforcement 
agencies that have less than 40 police officers. It is incumbent upon the federal gov- 
ernment and large police departments to ensure that smaller agencies are kept in- 
formed and understand the importance of intelligence information, Formal liaisons 
should be established, and eveiy agency no matter how small should have an ac- 
cessible representative that is familiar with handling intelligence information. 

I also believe that federal and local law enforcement should consider expanding 
its homeland security efforts beyond traditional parameters. We need to examine 
the possibility of establishing intelligence conduits with other local government com- 
ponents. Firefighters, paramedics and health workers, are well positioned to con- 
tribute valuable information to help protect our communities. In order to harness 
these types of resources, intelligence-sharing networks must be more inclusive. Fur- 
ther, the intelligence community will also need to work on developing and sharing 
intelligence that is actionable for other professions. We should begin planning for 
this new front now. 

Finally, local law enforcement recognizes that in addition to needing timely intel- 
ligence from federal agencies, we also must be willing and able to share timely and 
useful information gathered at the local level with our federal state, and local part 
ners. This is what the fusion center concept is all about. Local law enforcement 
stands ready to do its part in contributing to and receiving and acting upon the 
information that we hope will be shared more extensively in the future. 

Ultimately, such improvements in intelligence sharing will make our nation safer, 
as the federal government as local first responders work jointly as first preventers. 

Thank you again for the opportunity to appear before you today. 

Ms. HARMAN. Thank you, Chief. Your testimony is very impor- 
tant for the hearing record. 
Mr. Downing? 
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STATEMENT OF MICHAEL DOWNING, ASSISTANT 
COMMANDING OFFICER, COUNTER-TERRORISM/CRIMINAL 
INTELLIGENCE BUREAU, LOS ANGELES POLICE DEPARTMENT 

Mr. Downing. Chairman Harman, Ranking Member Reichert, 
members of the subcommittee, thank you for the opportunity to dis- 
cuss the Los Angeles Police Department's efforts to fight terrorism 
and the important issue of the over-classifi cation of intelligence. 

Having recently returned from an 8- week attachment to the new 
Scotland Yard's Counter terror ism Command, I have a much great- 
er appreciation for change and why we need to change. 

In Peter Clarke's words, the national coordinator for counterter- 
rorism, if you looked at the 30-year IRA campaign and look at the 
antithesis of that campaign, that is the threat that they have now. 



gamate it into the counterterrorism command is huge change for 
a culturally rich institution, and if they change, we certainly need 
to change. 

Local law enforcement's ability to play a significant role in stop- 
ping terrorism is seriously hampered by the over-classification of 
intelligence by the federal government. In Los Angeles, we enjoy a 
positive constructive partnership with various federal agencies, but 
the classification process has been a substantial roadblock to our 
capacity to investigate terrorism cases. 

The terrorist threat to our communities currently involves con- 
tinued domestic terrorism and international terrorists plotting to 
destroy American cities. Prior to September 11, local law enforce- 
ment agencies primarily investigated domestic terrorist groups, in- 
cluding white supremacists, hate groups, special issue groups con- 
ducting criminal activities. Investigations centered on familiar cul- 
tures that were socially motivated by political ideologies to commit 
terrorism. 

The bombing of the Alfred Murrah building in Oklahoma, in 
1995, the most notable domestic terrorist attack, had a catastrophic 
impact on American soil and brought together local and federal law 
enforcement to bring the terrorists to justice. Local law enforce- 
ment, in fact, played a critical role in the investigation and appre- 
hension of the offenders. 

I understand that you are coming to Torrance in a few weeks for 
a field hearing. The JIS case was an unclassified case that dealt 
in prison radicalization and conversion to gangs and terrorism. 
That was an unclassified case because it didn't have an inter- 
national connection. Had it had an international connection, it 
would have been classified and the outcome perhaps could have 
been much different. 

Prior to September 11, international terrorism was not in the na- 
tional consciousness. Despite the first World Trade Center bomb- 
ing, most Americans did not realize the significant threat of Islamic 
extremism and the consequences of this terrorism. September 11 
changed the mindset of all Americans, including local law enforce- 
ment. 

In addition, in the war on Afghanistan, and later in Iraq, the 
face of Islamic terrorism changed. No longer was the only threat 
a group of dissident Saudis hijacking a plane to crash into Amer- 
ican symbols of power. Throughout the world, suicide bombers at- 




special branch and amal- 
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tacked discos, train stations and buses. Islamic terrorism has con- 
tinued to demonstrate its reach and power from changing the out- 
come of the 2004 national election in Spain to paralyzing the trans- 
portation system in London in 2005. 

The terrorist transformed himself from Middle East foreigner to 
second and third generation local citizen. 

The sheer number of terrorist threats to our communities across 
the country has increased dramatically, and the federal govern- 
ment's capacity to collect intelligence and investigate these threats 
has been overwhelmed. Consequently, local law enforcement's ef- 
forts to counterterrorism has never been more important and has 
never been more critical. 

Across the country, a new concept of fusion centers arose, where 
analysts from police departments, FBI, Immigration and Customs 
Enforcement and other agencies worked on the same information 
screens to identify possible terrorist threats. 

In Los Angeles, the LAPD provides personnel to participate in 
the JRIC located in Norwalk, California. We have 14 other partici- 
p ating agencies in that center. 

The JRIC provides critical information-sharing opportunities 
with the federal government. However, over-classification of intel- 
ligence has become an impediment to full information sharing with 
the local law enforcement agencies who participate in the JRIC. As 
such, it has provided an impediment to the JTTFs, which is a great 
success story in our partnership with the federal agencies. 

After the 9/11 Commission issued its comprehensive report, 
America's local law enforcement community, consisting of over 700 
law enforcement officers, was reluctantly invited into the effort of 
countering the international terrorist threat. One part of the ra- 
tionale was that neither the CIA or DOD could conduct intelligence 
operations within the U.S. against American citizens. 

Moreover, the total number of FBI special agents assigned to 
protect over 18,000 cities, towns and villages throughout the 
United States is slightly over 12,000 people. This number becomes 
less reassuring when one examines the number of agents needed 
to handle the FBI's other responsibilities, including white collar 
crime, organized crime, public corruption, financial crime, fraud 
against the government, bribery, copyright infringements, civil 
rights violations, bank robbery, extortion, kidnapping, espionage 
and so on. 

At the national level, local law enforcement was not deemed an 
important stopgap in the field of counterterrorism, particularly in 
the area of Islamic extremists. In addition, the significant role 
of- 

Ms. Harman. Mr. Downing, could you please summarize at this 
point, because we are concerned that a vote will be called. 

Mr. Downing. Thank you. I will conclude, Ms. Chairman. 

The United States faces a vicious, amorphous and unfamiliar ad- 
versary on our land. Our previous defensive strategy to protect our 
cities was ineffective, and our current strategy is fraught with 
issues. We cannot support any process that takes us closer to an- 
other failure. 

We have mutual interest in working common direction to prevent 
acts of terrorism in the United States. The classification levels are 
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based on fear, the probability of information being disseminated to 
those that can cause serious damage to national security. What 
this system is not designed to do is to protect us against the threat 
itself. 

This is achieved by disseminating the information to people who 
stand the best chance of stopping violence against American cities, 
our first preventers and law enforcement. 

[The statement of Mr. Downing follows:] 

Prepared Statement of Michael P. Downing 
March 22, 2007 

I. Introduction 

Chairman Thompson, Chairwoman Hannan, Ranking Member Reichert, and 
Members of the Subcommittee, thank you for the opportunity to discuss the Los An- 
geles Police Department's (LAPD) efforts to fight terrorism and the important issue 
of the over classification of intelligence. 

Local law enforcement's ability to play a significant role in stopping terrorism is 
seriously hampered by the over classification of intelligence by the federal govern- 
ment. While in Los Angeles we have enjoyed a very positive and constructive part- 
nership with various federal law enforcement agencies, including the Federal Bu- 
reau of Investigation's (FBI) Los Angeles Field Office and the Department of Home- 
land Security's Immigration and Customs Enforcement (ICE), the classification proc- 
ess has been a substantial roadblock to our capacity to investigate terrorism cases 
and work hand-in-hand with these federal agencies. 

II. The Terrorist Threat to Our Local Communities 

The terrorist threat to our communities currently involves continued domestic ter- 
rorism and international terrorists plotting to destroy American cities. 

A. Domestic Terrorism 

Prior to September 11, local law enforcement agencies primarily investigated do- 
mestic terrorist groups, including white supremacists, hate groups, and special- 
issues groups conducting criminal activity (e.g. the Animal Liberation Front). Inves 
tigations centered on familiar cultures that were socially motivated by political 
ideologies to commit terrorism. The bombing of the Alf red P. Murrah Federal Build- 
ing in Oklahoma in 1995, the most notable domestic terrorist attack, had a cata- 
strophic impact on American soil and brought together local and federal law enforce- 
ment to bring the terrorists to justice. 1 Local law enforcement, in fact, played a crit- 
ical role in the investigation and apprehension of the offenders. 

B. International Terrorism 

Prior to September 11, 2001, international tei-rorism was not in the national con- 
sciousness. Despite the first World Trade Center bombing, most Americans did not 
realize the significant threat of Islamic extremism and the consequences of inter- 
national terrorism. September 11 changed the mindset of all Americans including 
local law enforcement. 

Since September 11, the scope of terrorism and extremism has increased exponen- 
tially. In addition, as the war in Afghanistan and later in Iraq waged on, the face 
of Islamic terrorism changed. No longer was the only threat a group of dissident 
Saudis hijacking a plane to crash into American symbols of power. Throughout the 
world, suicide bombers attacked discos, train stations, and buses. Islamic terrorism 
has continued to demonstrate its reach and power from changing the outcome of the 
2004 national election in Spain to paralyzing the transportation system in London 
in 2005. The terrorist transformed himself from Middle East foreigner to second and 
third generation local citizen. 

The sheer number of terrorist threats to our communities across the country has 
increased dramatically and the federal government's capacity to collect intelligence 
and investigate these threats has been overwhelmed. Consequently, local law en- 
forcement's efforts to counter terrorism have never been more important or critical. 

III. LAPD's Response to Terrorist Threats 
A. Counter-Terrorism Bureau 



'The 1993 World Trade Bombing was seen as international terrorism and investigated by the 
FBI. 
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The Los Angeles Police Department has taken the threat of international ter- 
rorism very seriously. The city has a population of over 4 million and spans over 
approximately 500 square miles. The region is home to numerous potential terrorist 
targets including the Los Angeles International Airport, the ports of Los Angeles 
and Long Beach, and the entertainment industry .In response, the LAPD has in- 
vested numerous hours and millions of dollars toward preparedness and response 
to a possible terrorist attack. In addition, the LAPD has created a Counter-Ter- 
rorism/Criminal Intelligence Bureau with nearly 300 officers who are solely dedi- 
cated to counter-terrorism and criminal intelligence gathering. While this bureau 
has served a critical function in the war against terror, the LAPD has been required 
to dedicate officers to intelligence gathering, a function typically performed by the 
federal government. 

B, Joint Regional Intelligence Center and Joint Terrorism Task Force 
Across the country, a new concept "fusion centers" arose where analysts from po- 
lice departments, the FBI, Immigration and Customs Enforcement, ana other agen- 
cies worked on the same information streams to identify possible terrorist threats. 
In Los Angeles, the LAPD provides personnel and participates in a Joint Regional 
Intelligence Center (JRIC), located in Norwalk, California, which includes fourteen 
participating agencies. The JRIC provides a critical information sharing opportunity 
with the federal government. However, the over classification of intelligence has be- 
come an impediment to full information sharing with the local law enforcement 
agencies who participate in the JRIC. 

The LAPD, as well as other Los Angeles area law enforcement agencies, is an ac- 
tive participant in the Joint Terrorism Task Force (JTTF). Like the JRIC, the JTTF 
also serves as an excellent partnership with federal law enforcement agencies and 
provides the opportunity for extensive information sharing. The same impediments 
of the JRIC, however, apply to the local law enforcement agencies participating in 
the JTTF. The dissemination of critical intelligence is restricted due to its over clas- 
sification. 

IV. The Consequences of Over«Classif ication of Intelligence 

After the 9/11 Commission issued its comprehensive report, America's local law 
enforcement community, consisting of over 700,000 law enforcement officers, was re- 
luctantly invited into the effort of countering the international terrorist threat. One 
part of the rationale was that neither the Central Intelligence Agency nor Depart- 
ment of Defense could conduct intelligence operations within trie United States 
against American citizens. Moreover, the total number of FBI Special Agents as- 
signed to protect over 18,000 cities, towns, and villages throughout the United 
States is slightly over 12,000. This number becomes less reassuring in the when one 
examines the number of agents needed to handle the FBI's other responsibilities in- 
cluding white collar crime, organized crime, public corruption, financial crime, fraud 
against the government, bribery, copyright infringement, civil lights violations, 
bank robbery, extortion, kidnapping, espionage, interstate criminal activity, drug 
trafficking, and other serious violations of federal law. 

At the national level, local law enforcement was not deemed an important stopgap 
in the field of counter-terrorism particularly in the area of Islamic extremists. In 
addition, the significant role of local law enforcement in the fight against inter- 
national terrorism was not viewed as significant. More than five years after the 
tragic events of September 11, local law enforcement involvement has still not been 
fully embraced because of the impediment of information sharing and the over clas- 
sification of intelligence. 

The result of including local law enforcement is that uniform police officers, bomb 
squads, and hazardous material teams now train together to address terrorist 
threats with the FBI, Department of Energy, Federal Emergency Management 
Agency, and the Department of Homeland Security, and train to respond to possible 
terrorist scenarios. 

Local law enforcement has had a long history in investigating individuals and 
groups while developing and handling human and electronic intelligence. No agency 
knows their landscape better than local law enforcement; it was designed and built 
to be the eyes and ears of communities. Over classification, however, prevents a true 
partnership with federal agencies. 

An impediment for both federal and local agencies, for example, is that local FBI 
agents, cannot change the originating agency's classification level, and this problem 
is amplified when the response to the threat is time sensitive. Appropriate law en- 
forcement response to substantial threats can be significantly impaired with mini- 
mal lead time, creating greater risk to the community, and impacting the ability for 
a "First Preventer" response. A local field agent, however, has the discretion to clas- 
sify a case as "secret." The criteria for this classification is "secret shall be applied 
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to information, the unauthorized disclosure of which reasonably could be expected 
to cause serious damage to the national security." Additionally, the standard used 
for "secret" for intelligence information is "the revelation of significant intelligence 
operations." Many field agents may over-classify their cases for fear of compromise. 
Unfortunately, this is a double edge sword because it stifles collaboration with local 
law enforcement. 

The burden to overcome is that the investigations push up against federal inves- 
tigations, which in turn become classified. The result is the old adage of local law 
enforcement pushing information to federal agencies without getting anything back. 
The federal fix has been to brief the Chief of the executive staff of classified cases, 
but restricted the dissemination to their intelligence units (despite proper clearance 
levels of personnel). The result is to develop separate and likely redundant intel- 
ligence gathering operations. For example, New York was first in the countiy to dis- 
engage from relying on the federal agencies to protect their city, committing almost 
1,200 officers to counter terrorism efforts. Currently, the association of Major Cities 
Chiefs of Police is campaigning in Congress to send police officers overseas to obtain 
inf ormation from their ponce counterparts rather than rely on our own federal agen- 
cies to share information. 

V. Recommendation 

The declassification of information currently classified at the secret level would 
greatly improve the information-sharing environment and build upon the counter- 
terrorism capabilities of local law enforcement. Federal authorities should consider 
changing the criteria classification of terrorism-related intelligence to "Law Enforce- 
ment Sensitive" to enable the dissemination of information to critical personnel in 
the field. "Top Secret" should be an exceptional classification that requires extraor- 
dinary demonstration of need while "Secret" should be a classification that requires 
more stringent demonstration of need than currently required. 

Local law enforcement already works in an environment with a "right and need 
to know" and efforts made to declassify "secret" information to "law enforcement 
sensitive" would not only make for more effective and timely intelligence, but in- 
spire true partnership, better collaboration, the building of more robust trust net- 
works, and develop a richer picture with regard to community intelligence. 

VI. Conclusion 

The United States faces a vicious, amorphous, and unfamiliar adversary on our 
land. Our previous defensive strategy to protect our cities was ineffective and our 
current strategy is fraught with issues. In Los Angeles, we cannot support any proc- 
ess that takes us closer to another failure. We have the mutual interest and are 
working in common direction to prevent acts of terrorism in the United States. The 
classification levels are based on fear: the probability of information being dissemi- 
nated to those that can cause serious damage to national security. What this system 
is not designed to do is protect us against the threat itself. Local law enforcement 
has a culture and capacity that no federal agency enjoys; the know how and ability 
to engage a community and today it is a vital part of the equation. This is achieved 
by disseminating the information to people who stand the best chance of stopping 
violence against American cities: our first preventers in local law enforcement. 

Ms. Harman. Thank you very much. 

The chair now recognizes the chairman of the full committee, the 
gentleman from Mississippi, for 5 minutes of questions. 

Mr. Thompson. Thank you very much, Madam Chairman. I ap- 
preciate the opportunity. 

Chief Lanier, nice to see you again. You do us proud. 

Chief Lanier. Thank you. 

Mr. Thompson. Mr. Downing, New York City saw that they had 
a problem with cooperation and communication with respect to in- 
telligence. So they created their own intelligence division to kind 
of address many of the items you shared with us today. 

What has the Los Angeles Police Department put together to ad- 
dress some of the issues that we are talking about today? 

Mr. Downing. We have our own intelligence section as well, 
probably 30 people dedicated to gathering intelligence within our 
major crimes division, which does not include the Joint Regional 
Intelligence Center. 
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The Joint Regional Intelligence Center sits on top of seven coun- 
ties that the L.A. FBI office is in charge of. We have approximately 
44 people in that center, growing to 80. It is going to be a 7-day, 
24-hour operation. It is an all crimes, all hazards approach to intel- 
ligence. However, with the minimal staffing right now, it is pri- 
marily terrorism. But that is how we deal with it. 

The FBI has established that as a top-secret level JRIC center. 
It is managed by the L.A. sheriffs, LAPD and the FBI, with the 
FBI as the functional lead in the center. 

Mr. Thompson. Thank you, and I will get back to the other part. 

Chief Lanier, do you believe that you are receiving all the infor- 
mation, or your department is receiving all the information nec- 
essary from federal government sources at this point? 

Chief Lanier. No, I am sure I am not. 

Mr. Thompson. And without pointing fingers, can you tell me 
who is good, who is not so good, who is deserving of being better? 
Because what we are trying to do with the hearings is trying to de- 
termine where we need to start to focus. For instance, I will give 
you a good example, our Capitol Police happen to use analog ra- 
dios. Well, they can't talk to anybody but themselves, because ev- 
erybody else is digital. And that is a problem. So if we can't talk 
to each other from an interoperability standpoint, I am wondering 
how much of the sharing of intelligence and other things. 

So if you could kind of give me your analysis of what you have 
found so far. 

Chief Lanier. I can walk that fine line there, sir. 

Mr. Thompson. All right. 

Chief Lanier. First of all, I always believe if I am going to criti- 
cize anybody for anything, we have to look at ourselves first. And 
I will say that local law enforcement needs to do a better job of 
clearly articulating what our intelligence needs are to the various 
intelligence agencies so they know what to give us. 

It took some pushing from me — fortunately, I had the support 
from Chief Ramsey — to go to the right people and the right agen- 
cies and say, "This is what I need and why I need it." It is not 
enough to say, as a police chief, "You are not giving me enough in- 
formation; give me more." 

If the other federal agency doesn't know what it is that I need, 
they are going to give me what they think I need. So I need to lay 
that out very clearly. So we are guilty as well. 

With that said, now I can throw other stones. I do think that the 
participation of the JTTF has increased the information-sharing 
flow with the FBI because there is a longstanding history there. 
The new players in the game, through the Department of Home- 
land Security, does not have that longstanding relationship and 
well-established conduit for information to flow clearly. 

And, I don't want to oversimplify this, but I think it is really, 
really important that in a lot of cases it boils down to the right peo- 
ple, in the right place, having an opportunity to sit down and have 
a dialogue. I would be happy to sit down with somebody in this 
classification issue and have them sit across the table from me, as 
a police chief in the nation's capital, and look me in the eyes and 
listen to what I have to say about what my needs are and then tell 
me why I shouldn't have that. 
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Mr. Thompson. You do a good job. 
Chief Lanier. Thank you. 
Mr. Thompson. Thank you very much. 
I yield back, Madam Chair. Thank you. 
Ms. Harman. Thank you, Mr. Chairman. 

The chair now yields 5 minutes for questions to the ranking 
member, Mr. Reichert, from Washington. 
Mr. Reichert. This brings back memories to me. 
Ms. Harman. Nightmares. 

Mr. Reichert. Yes. Everything that you have each said I strug- 
gled with as the sheriff in Seattle. And the sharing of information 
between the federal agencies and local sheriffs office and the local 
Seattle Police Department and the other 38 police departments in 
King County, every one of those chiefs would be saying exactly the 
same thing that both of the witnesses have said today. 

When you talk about information sharing, of course one of the 
things that we know is a necessity in these days is technology. 

Are either of you familiar with the LInX System? 

Chief Lanier. Yes. 

Mr. REICHERT. Are you participants in that program or beginning 
to become involved in that program or where do you stand, each 
of you? 

Chief LANIER. We are not yet, but we are in the process of get- 
ting there. As you might have seen in some of my public testimony 
lately, technology is still a significant struggle for the Metropolitan 
Police Department. We are moving forward and bringing up our fu- 
sion center, so we are on our way, and we will be full participants 
in the LInX Program, so we are getting underway with that now. 

Mr. Reichert. Great. 

Mr. DOWNING. Yes. And we, as well, are beginning in that proc- 
ess. We have cops LInX, which connects the agencies within the 
different counties, and some of the counties that can't afford it are 
not participating but looking forward to the installation of LInX, 
which will also bring in the federal system. 

Mr. Reichert. Yes. Who is the lead on the LInX Systems in your 
areas? 

Mr. DOWNING. Chief Baca, Chief Bratton, Chief Corona, from Or- 
ange County. 

Mr. Reichert. Who from the federal government, do you know? 
Mr. DOWNING. Well, Steve Tidwell in the L.A. office is assisting 
us with that. 

Mr. Reichert. I just visited your fusion center a couple weeks 
ago. 
Chief? 

Chief LANIER. In Washington, D.C., it is being coordinated 
through the Council of Governments, the COG, which is regional. 
Mr. Reichert. How big is your department? 

Chief LANIER. We will be at 3,900 by the end of this year and 
probably 4,200 by the end of next year. 

Mr. Reichert. How many people are assigned to homeland secu- 
rity? 

Chief LANIER. You are going to get me in trouble with my local 
constituents, but I will tell you. 
[Laughter.] 
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I have approximately 30 in the Office of Homeland Security and 
Counterterrorism, but I do have a Special Operations Division that 
is 225, 230 people, and I am about to merge those two units to- 
gether so that every member of the Special Operations Division 
will now take part in that. 

Mr. REICHERT. And other than UASI money, are you getting any 
federal assistance, grant monies to pay for those bodies? 

Chief LANIER. To pay for those bodies? 

Mr. REICHERT. Yes. 

Chief Lanier. Now you are really going to get me in trouble. 
Mr. REICHERT. I know the answer to that one, so go ahead. 
[Laughter.] 

Chief LANIER. There are a variety of grant funds under the 
homeland security program, LETPP, as you know, and the state 
funds as well, the UASI, but we struggle to get sometimes reim- 
bursement for federal duties that involve dignitary protection and 
things 

Mr. REICHERT. You have some unfunded mandates. 
Chief Lanier. Yes. 
Mr. REICHERT. Yes. 
Mr. Downing? 

Mr, DOWNING. Yes. Our department is 9,500. We have just under 
300 assigned to the Counterterrorism Bureau, which is primarily 
the terrorist-related matters. We are one of the six tier one cities 
in UASI. This year's UASI allows us to get 25 percent of the total 
grant toward personnel costs. 

Mr. REICHERT. Okay. I have no further questions. 

I yield. Thank you. 

Ms. HARMAN. I thank the ranking member, and I have a few 
questions. 

First, I want to thank both witnesses for excellent testimony. 

Our goal in this session of Congress is to put ourselves in your 
shoes to think about what are the opportunities and frustrations of 
our local first preventers and how can we make the sharing of in- 
formation with them and the tools that they need more effective? 
Because if you can't do your jobs well, we can't protect America. It 
is that simple. 

It is not all in Washington, D.C. I know that may come as a 
shock to a few folks, but it is not all here. 

And vertical information sharing has to be adequate, and hori- 
zontal information sharing at the local level has to be adequate too. 
And that is another issue that neither of you raised today but it 
is something that has been raised by prior witnesses. 

Both of you provided some useful information. 

I am quite horrified to think, Mr. Downing, that if the informa- 
tion about that cell in Torrance had had some international connec- 
tion, we might have missed the whole thing. 

That gets my attention, because in a couple of weeks when we 
are in Torrance, California, congratulating the Torrance PD for ex- 
cellent local police work, we are going to talk about how dev- 
astating could have been attacks by a homegrown terrorist cell liv- 
ing next door to some of my constituents had we not prevented 
them from doing anything. So I just want to observe that. 
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And, Chief Lanier, you make a very good point when you say it 
is your obligation to make clear to federal agencies what you need 
and why you need it. I mean, that is a job you have, and you can't 
just assume they are going to figure it out. In fact, they are not 
going to figure it out. You have to be an advocate for your own 
needs. 

And it is in that connection that I want to ask this question. The 
chairman of the full committee has had a long and friendly con- 
versation with Charles Allen of the Department of Homeland Secu- 
rity's Office of Intelligence and Analysis — we call it I&A — about the 
need for local participation either on the NCTC or connected to the 
NCTC. And some of us were dismayed to learn in a visit we made 
recently to the NCTC that the new agency about to be created, 
called the Interagency Threat Assessment and Coordination Group, 
the ITACG, might have on it one representative of law enforce- 
ment. 

In questions to Charlie Allen last week, he said, "Well, maybe 
that will change to two or three." I clearly don't know how many 
members of the ITACG there will be, but I would just like to ask 
both of you, as consumers of necessary intelligence, what do you 
think about the idea of one person or maybe two or three partici- 
pating in the NCTC process? 

Chief Lanier. Well, it is at least a start, but I will say this: Po- 
lice departments around the country have very different needs 
based on the jurisdictions they serve as well as the capabilities that 
they have. 

So in the Metropolitan Police Department, a large city police de- 
partment, I have a lot of capabilities that a small town police de- 
partment may not have. But at the same token, that small town 
police department, or sheriffs department, may have some 
vulnerabilities and some other understandings that I don't have. So 
I think the representation needs to be fair and representative 
across the board. 

State agencies, state patrol, highway patrol officers have dif- 
ferent skills and capabilities than transit police, than urban police, 
than university police. So there needs to be an adequate represen- 
tation. 

Ms. Harman. Mr. Downing? 

Mr. Downing. I absolutely agree, and to take it even further, in 
coming back from the U.K., they have 17 people in 17 different 
parts of the world, and they are growing to 21. And as New York, 
they have eight people in eight different parts of the world as well. 
We are interested in that as well, because we are not sure that the 
local perspective is being placed on foreign intelligence. 

Ms. Harman. I thank you for that, and I actually share that big 
time. I think that information sharing has to go horizontally and 
vertically and that your help in designing the products that you 
will use is absolutely indispensable. Otherwise, they may not be 
useful to you. 

It is your point, Chief Lanier, we have to be advocates for what 
we need and why we need it, so I think you should be sitting inside 
the room when our National Intelligence Fusion Center is devel- 
oping products that you are supposed to use. And then I think our 
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next problem is to make sure that the classification system gets re- 
vised so that you are in a position to use them. 

My time has expired. I don't want to abuse this opportunity. And 
I have spoken more than others. 

Let me just ask either of the members, starting with Chairman 
Thompson, whether you have any concluding remarks. 

The ranking member? 

Mr. REICHERT. Thank you, Madam Chair. 

I just want to, again, thank you for being here and taking time 
out of your busy schedule to testify. And as we have learned today 
and previous hearings from this information, we have a lot of work 
to do, and we look forward to working with you to help make our 
country safer. 

Thank you all. 

Ms. Harman. The hearing is adjourned. 

[Whereupon, at 11:34 a.m., the subcommittee was adjourned.] 
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THE RESPONSE OF THE PROGRAM 
MANAGER OF THE INFORMATION 
SHARING ENVIRONMENT 
PART II 



Thursday, April 26, 2007 

U.S. House of Representatives, 
Committee on Homeland Security, 
Subcommittee on Intelligence, Information Sharing, 

and Terrorism Risk Assessment, 

Washington, DC, 
The committee met, pursuant to call, at 10:05 a.m., in Room 
1539, Longworth House Office Building, Hon. Jane Harman [chair- 
woman of the committee] presiding. 

Present: Representatives Harman, Langevin, Thompson, 
Reichert, and Dent. 

Ms. HARMAN. [Presiding.] Good morning. The subcommittee will 
come to order. 

The subcommittee is meeting today to receive testimony on "The 
Over-Classification and Pseudo-Classification of Government In- 
formation: The Response of the Program Manager of the Informa- 
tion Sharing Environment." 

We are here today because our classification system is broken 
and because pseudo-classifications are making effective information 
sharing nearly impossible. 

A few weeks ago, we heard from experts in these areas who de- 
scribed an expanding problem that is making securing the home- 
land harder. Last fall, the president appointed Ambassador Ted 
McNamara to take on the pseudo-classification issue, and the am- 
bassador has worked a solution that the White House is reviewing. 

His proposed controlled unclassified information, CUI, frame- 
work holds a lot of promise, but no matter how good this solution 
might be, if federal agencies don't get on board, and fast, well- 
planned and well-meaning efforts will fail. 

I commend Ambassador McNamara, with whom I have met sev- 
eral times, for including state and local law enforcement officers in 
his process from the outset. The ambassador's working group wel- 
comed law enforcement as part of the process from day one, as well 
they should have. 

Police and sheriffs officers are among the people who will be 
most affected by this new CUI framework. As all of us on the sub- 
committee have stated, we cannot have a successful fix to the pseu- 
do-classification and other information sharing challenges unless 
all affected parties are involved in structuring the solution. 

(39) 
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I hope that DHS is listening. You should know, and I think you 
do, that this subcommittee is extremely concerned with the absence 
of numbers of state and local participants in the new ITACG that 
is being developed as an adjunct to the NCTC. We think that is a 
problem, and we are going to stay on that problem and hopefully 
change what is happening. 

So in this case, in addition to Ambassador McNamara and our 
DHS and FBI witnesses, we are joined this morning by Mark 
Zadra, the assistant commissioner of the Florida Department of 
Law Enforcement. Mr. Zadra will talk to us about the promise and 
potential pitfalls of the CUI framework from his state-level per- 
spective. 

I would note with sadness, however, that we are not joined today 
by Colonel Bart Johnson of the New York State Police, who had 
been invited as a witness and was originally scheduled to testify. 
Late yesterday, two of his officers were shot while attempting to 
apprehend a criminal suspect on Tuesday, and one, Trooper David 
Brinkerhoff, died from his injuries. Our condolences, and obviously 
the condolences of the entire Committee on Homeland Security, go 
to his family and his colleagues. 

And I ask unanimous consent to enter his prepared remarks into 
the record at this point. Hearing no objection, we will do so. 

[The statement of Colonel Johnson follows:] 

Forthk Record 
Prepared statement of Colonel Bart R. Johnson 
April 26, 2007 

Chairman Thompson, Ranking Member King, Chairwoman Harman, and Mem- 
bers of the Subcommittee, I sincerely appreciate the opportunity to appear before 
you today to discuss state and local law enforcement's involvement with standard- 
izing procedures for sensitive but unclassified (SBU) information and related issues 
impacting local, state, and tribal law enforcement. 

I have served with the New York State Police for more than 24 years, and I have 
over 30 years experience in law enforcement. Presently, I serve as the Deputy Su- 
perintendent in charge of Field Command. I oversee the Bureau of Criminal Inves- 
tigation, the Uniform Force, the Office of Counter Terrorism, Intelligence, and the 
associated special details of these units. I also have the privilege to serve as the vice 
chair of the U.S. Department of Justice's (DOJ) Global Justice Information Sharing 
Initiative (Global) Advisory Committee, the chair of the Criminal Intelligence Co- 
ordinating Council (CICC) and of the Global Intelligence Working Group (GIWG). 
In these capacities, I have been fortunate to actively participate in discussions relat 
ing to intelligence reform, and I have provided significant input to the federal gov- 
ernment regarding information sharing and intelligence. 

I expect that we would all agree that the current number of sensitive but unclas- 
sified (SBU) designations and the lack of consistent policies and procedures for un- 
classified information severely hinder law enforcement's ability to rapidly share in- 
formation with the officials that need it to protect our countiy, its citizens, and visi 
tors. Much progress has been made recently in addressing the classification issue 
by way of Guideline 3, and much of the headway is due to the leadership and efforts 
of Ambassador Thomas E. McNamara of the Offiee of the Program Manager for the 
Information Sharing Environment (ISE) and the other relevant federal agencies. I 
am gratified that I have also had the opportunity to contribute to this effort. 

For many years, law enforcement agencies throughout the countiy have been in- 
volved in the sharing of information with one another regarding investigations, 
crime reporting, trend analysis, and other types of information considered law en- 
forcement sensitive. Oftentimes, these investigations involve public corruption, orga- 
nized crime, narcotics, and weapons smuggling, and they frequently involve the use 
of undercover operations, confidential sources, and lawful covert electronic surveil- 
lance. State, local, and tribal law enforcement agencies do not have the ability to 
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classify their material, and we must be assured that strict control is used when han- 
dling and distributing this type of data to ensure that the information and inves- 
tigation are not compromised and that we do not sustain a loss of a life. Also, since 
September 11, 2001, law enforcement agencies nationwide are more fully involved 
in the prevention, mitigation, and deterrence of terrorism, and consequently, they 
receive more information and intelligence from their federal counterparts. 

Moreover, many law enforcement agencies generate their own information and in- 
telligence (much of which is collected in a sensitive manner) that is passed to other 
law enforcement agencies for their possible action. Law enforcement agencies have 
also begun to share information with new stakeholders in the fight against ter- 
rorism. They now routinely share information with non law enforcement govern- 
ment agencies and members of the private sector in order to assist in prevention 
efforts. This activity has altered the information sharing paradigm. 

Another issue that exists within the current environment is the apparent "over 
classification" of material. Over-classifying data results in information and intel- 
ligence not being sent to the law enforcement professionals on the front lines of the 
fight against terrorism in this country the officers, troopers, and deputies in the 
field. It still appears to be a difficult process for the federal intelligence community 
to develop "tear-line" reports that can be passed to law enforcement so that the in 
telligence can be operationalized in an effective and proactive manner.Up until a 
short time ago, there was a lack of a coherent, standardized process for marking 
and handling SBU data. Lack of consistency in markings led to confusion and frus- 
tration among local, state, tribal, and federal government officials and also a lack 
of confidence in knowing that the information that was shared was handled in an 
appropriate and secure manner. Recent studies by the Government Accountability 
Office, the Congressional Research Service, and other institutions have confirmed 
and highlighted the problems created by the various markings and the lack of com- 
mon definitions for these designations. These studies revealed that there are over 
120 different designations being used to mark unclassified information so that agen- 
cies can "protect" their information. These pseudo classifications did not have any 
procedures in place outlining issues such as who can mark the material' the stand- 
ards used to mark the material; who can receive the information; how the informa- 
tion should be shared, who it could be shared with, and how it should be stored; 
and what impact, if any, these markings have on the Freedom of Information Act. 

As a result of several key federal terrorism related information sharing authori 
ties, such as the Intelligence Reform and Terrorism Prevention Act of 2004, Execu- 
tive Order 13388, and the December 2005 Memorandum from the President regard- 
ing Guidelines and Requirements in Support of the Information Sharing Environ 
ment, specifically Guideline 3, much work has been undertaken to bring about intel- 
ligence reform in this country. Local, state, and tribal law enforcement have been 
and continue to be active and collaborative participants in this undertaking. 

As a representative of the New York State Intelligence Center (NYSIC) 1 and 
DOJ's Global Initiative, I have participated in a number of efforts to implement the 
guidelines and requirements that will support the ISE. Recognizing the need to de- 
velop a process for standardizing the SBU process, the CICC ana GIWG commis- 
sioned a task team in May 2006 to develop recommendations that would aid local, 
state, and tribal law enforcement agencies in fully participating in the nationwide 
information sharing environment. This work was done with the Federal Bureau of 
Investigation, the U.S. Department of Homeland Security, the Office of the Program 
Manager for the Inf ormation Sharing Environment, and other law enf orcement enti- 
ties. The recommendations made by that team were provided to an interagency SBU 
working group. Subsequently, I participated on the SBU Coordinating Committee 
(CC) that was established to continue the Guideline 3 implementation efforts begun 
by the interagency group. 

As you know, the SBU CC recommendations are currently under review and 



Controlled Unclassified Information (CUI) Regime that is designed to standardize 
SBU procedures for inf ormation in the ISE. The recommendations include requiring 
controls on the handling and dissemination of SBU information. By and large, I be- 
lieve local, state, and tribal agencies will support the new CUI Framework because 
they want to be active participants in the ISE and are supportive of clear and easily 
understandable protocols for sharing sensitive information. 

Local, state, and tribal agencies want to be able to receive terrorism, homeland 
security, and law enforcement information from the federal government and clearly 
understand, based on the markings on the data, how the data should be handled 
and stored and to whom the information can be released. The data should be dis 



formerly known as the Upstate New York Regional Intelligence Center (UNYRIC). 




new 
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seminated as broadly as possible to those with a need to know, including non law 
enforcement public safety partners, public health officials, and private sector enti- 
ties. Conversely, local, state, and tribal entities are frequently the first to encounter 
terrorist threats and precursor criminal information, and the new CUI markings 
will assist with sharing that type of information both vertically and horizontally 
while respecting originator authority. 

A number of critical issues must be addressed at the local, state, tribal and fed- 
eral levels in order to facilitate a successful CUI Regime implementation, including 
training, policy and procedural changes, system modifications and enhancements, 
and funding to implement these recommendations. 

Emphasis must be placed on the development and delivery of training to local, 
state, tribal, and federal pei"sonnel on the CUI Framework. Because of the possi- 
bility of wide distribution of sensitive inf ormation, it is imperative that training be 
given a priority so recipients have a clear understanding of marking and handling 
procedures. In order to maximize the effectiveness of the training and reach the ap- 
propriate recipients at the local, state, and tribal levels, I recommend that it be pro- 
vided on a regional basis across the country to personnel in the designated state- 
wide fusion centers. Focusing on fusion center officials in the initial delivery phase 
directly supports the national information sharing framework that calls for the in- 
corporation into the ISE of a national network of state and major urban area fusion 
centers. 

In support of the ISE, state and major urban area fusion centers will be contrib- 
uting information to ongoing federal and national level assessments of terrorist 
risks; completing statewide, regional, or site-specific and topical risk assessments; 
disseminating federally generated alerts, warnings, and notifications regarding 
time sensitive threats, situational awareness reports, and analytical products; and 
supporting efforts to gather, process, analyze, and disseminate locally generated in- 
formation such as suspicious incident reports. Over 40 states currently have oper- 
ational fusion centers, and it is critically important that center personnel receive 
timely, relevant training to enable them to fully function in the national ISE. 

Training will provide insight and an understanding of how the CUI handling and 
disseminating requirements affect business processes. This will cause agencies to 
execute policy and procedural changes and system modifications. There are poten- 
tially over 18,000 local, state, and tribal law enforcement agencies in our country 
that could be impacted by the implementation of the CUI Framework. I believe that 
the federal government working collaboratively with local, state, and tribal au- 
thorities should develop model policies and standards to aid in the transition to 
the Framework. Funding issues will be a major factor for local agencies, especially 
in regard to modifying/enhancing information technologies and applying encryption 
requirements to ensure proper transmission, sto age, and desti*uction of controlled 
inf ormation. 

It will be through these ongoing collaborative efforts regarding Guideline 3 that 
the ISE will take another step towards being the meaningful and cooperative shar- 
ing environment that it was intended to be. These actions will result in the matura- 
tion of information sharing among state, local, and tribal agencies; p ivate entities; 
and their federal counterparts, which will in turn assist in our collective efforts to 
prevent another terrorist attack and reduce violent crime. Our goal should be to 
share as a rule and withhold by exception, according to l-ules and policies that pro- 
tect the privacy and civil rights of all. 

Being involved in the CUI Framework development process has been a rewarding 
and sometimes arduous experience. It is a process that I and the entire state, local, 
and tribal law enforcement community take very seriously. It is very encouraging 
to me that the Office of the Program Manager and other relevant partner federal 
agencies have made g eat strides in recognizing the value that local, state, and trib- 
al officials bring to the table. We want to remain active, ongoing partners and par- 
ticipants with the federal government as we work towards a national information 
sharing environment. 

Mr. Chairman, I thank you and your colleagues for giving me the opportunity to 
speak to you today, and I hope my comments have been of some use to you in your 
deliberations. 

Ms. Harman. But I would also note that our police, sheriffs and 
firefighters are our front lines. They take all the risks to keep our 
country safe, and on behalf of a grateful nation, we send, again, our 
condolences and appreciation to the New York State Police. 

Today, we will also focus on how best to support the CUI frame- 
work at the federal level. That is why DHS aiid FBI are testifying. 
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Last month, we learned that every agency in the federal govern- 
ment has invented pseudo-classifications for their particular brand 
of information. The increasing number of these markings has led 
to tremendous confusion. 

Obviously, that proliferation is a problem, and our goal here is 
to find out whether Ambassador McNamara's new framework is 
one that will be embraced, as it should be, by those federal agen- 
cies that are in the same line of work. If we can't get it right at 
the federal level, we can't expect state and local entities to do any 
better. We are late in this process, and we can and should move 
faster. 

I hope this hearing will help us figure out how to move from a 
good proposal to a good adopted strategy across the federal govern- 
ment and with our state and local partners. 

I would like to, again, extend a warm welcome to our witnesses 
who will be talking about these issues, and I look forward to your 
testimony. 

I now yield time for opening remarks to the ranking member, 
Sheriff Reichert. 

Mr. Reichert. Thank you, Madam Chair. I like that "sheriff' 
title. Thank you for using that. 

I, first of all, apologize. My voice is a little hoarse this morning. 
I am experiencing some effect from the oak pollen, I think, that is 
flying around out here. I am not used to that back in Seattle. 

Second, let me also share my condolences with the New York 
State Police. I have experienced the loss of heartbreak myself in 
my 33-year career, and that is a tough one to take. 

Also, Ambassador, I would like to thank you for your briefing 
earlier this week. It was very helpful, and thank you again for 
being here today to share your thoughts on your new ideas and 
plans. 

I also want to say that I certainly recognize the difficulty that 
all three of you have in bringing the nation's state and local and 
federal agencies together to share information. Just on the local 
level, in the Seattle region, I know how tough that can be. So your 
job is going to be very tough, as we all recognize, but we certainly 
want to be a part of the solution with you. 

So today we meet on a topic of pseudo-classification, which is the 
use of document controls that protect sensitive but unclassified in- 
formation. This is the second hearing in a series on the problems 
of over-classification and pseudo-classification and information 
sharing. 

I believe it is essential that sensitive information be able to flow 
to those that need it, and I shared a story the other day with the 
ambassador, my own personal experience within the sheriff s office, 
people holding and withholding information and other police de- 
partments not wanting to share the information and therefore re- 
sulting in maybe a case not being resolved or solved or being solved 
much later than it could have. 

Information needs to flow in a trusted information sharing envi- 
ronment. The people who share sensitive information need to be 
able to trust that different federal agencies, as well as different 
states and localities, will treat their information with respect and 
protect sensitive information. 
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Currently, there is no trusted information sharing environment 
for sensitive, unclassified information. There are currently over 107 
unique markings for sensitive information and over 130 different 
labeling or handling processes, as we talked about the other day. 
This disparity creates confusion and leads to information not being 
properly protected. If a federal agency can't trust that sensitive, 
unclassified information will be protected, it will simply classify the 
document as secret or above, severely restricting access. 

If a private-sector entity or state/local agency does not believe its 
information will be protected properly, it simply will not share 
that, and I have experienced that myself. So without trust, the in- 
formation sharing environment breaks down. 

Creating a trusted environment is essential to the work of the 
program manager. Cleaning up a messy system of sensitive but un- 
classified designations is essential to creating that trust. 

We are looking forward to the program manager's testimony as 
well as the testimony of our DHS and FBI witnesses who will be 
able to discuss how these policies are progressing and how we can 
ensure the information sharing is a success. 

From the second panel, hopefully, we will hear from state law en- 
forcement. We have had a role in the process. The state and local 
perspective is essential, because without the state and local buy-in, 
as I said, collaboration will lead to not sharing information. 

We appreciate your testimony and your time this morning, and 
thank you again for being here. 

With that, I yield the balance of my time. 

Ms. HARMAN. The gentleman's time has expired. 

The chair now recognizes the chairman of the full committee, the 
gentleman from Mississippi, Mr. Thompson, for an opening state- 
ment. 

Mr. Thompson. Thank you very much, Madam Chair, and I join 
you in welcoming our distinguished witnesses today to this impor- 
tant hearing on the work being done by Ambassador McNamara. 

I also join you and our ranking members and others in express- 
ing our heartfelt sympathies to the New York State Police in the 
loss of their officer. Any front-line person puts his or her life on the 
line every day, and, unfortunately, sometimes these things happen. 
And that is why what we and is so important every day and what 
so many others do. 

But from information sharing, I think Representative Reichert 
spoke volumes when he said it is important to have information 
available in real-time. I was in local government before coming to 
Congress and I remember when agencies bragged about knowing 
something, and when other folks found out about it weeks and 
months later, they would say, "Well, we knew about that all the 
time." 

To me, it is a no-brainer not to share the information if we are 
supposedly all looking for the bad guys — or gals, in some instances. 
Ms. Harman. You had it right the first time, Mr. Chairman. 
[Laughter. ] 

Mr. Thompson. But the notion is we absolutely need to do it, but 
we are concerned that sometimes government over-classifies infor- 
mation so that it can't get out into the field. 
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And, Ambassador, I know you have a tough challenge ahead of 
you. We talked a little bit about it before the hearing, and I am 
looking for this new framework. I want the commitment to be 
there, to carry it forward. I would not like to see it become another 
in a long line of acronyms that get put on the shelf never to be 
taken off. So I look forward to your testimony, and I look forward 
to pushing forward the new ideas. 

The comfort zone, as all of us know, is we have always done it 
this way, but that doesn't necessarily mean that it is correct. And 
these are different times, different challenges and it calls for broad- 
er strategies. 

So I look forward to the testimony and the questions to follow. 
And I yield back. 

Ms. HARMAN. The gentleman's time has expired. 

And I would just observe, the comfort zone ended on 9/11. There 
is no comfort zone anymore. I am looking at a press clip today in 
the New York Times, which says, "British anti-terrorism chief 
warns of more severe al-Qa'ida attacks." These are in Britain, but 
obviously we can imagine this here. 

So in that spirit, I would hope that what we are talking about 
never hits a shelf. That should not even be an option. We have to 
change the way we do business. 

I welcome our first panel of witnesses. 

Our first witness, Ambassador Ted McNamara, is the program 
manager of the Information Sharing Environment, a position estab- 
lished by the Intelligence Reform and Terrorism Prevention Act of 
2004, a statute I am very familiar with. 

Ambassador McNamara is a career diplomat who originally re- 
tired from government service in 1998, after which he spent 3 
years as president and CEO of the Americas Society and Council 
of the Americas in New York. Following the September 11 attacks, 
he was asked to return to government service as the senior advisor 
for counterterrorism and homeland security at the Department of 
State. 

Our second witness, Dr. Carter Morris, is currently director of in- 
formation sharing and knowledge management for the Office of In- 
telligence and Analysis at the Department of Homeland Security. 
That is a mouthful. That can't even be one business card. 

He is a detailee to DHS from the Directorate of Science and 
Technology at CIA. Most recently, Dr. Morris served as the deputy 
assistant director of Central Intelligence for Collection where he 
helped coordinate all intelligence community collection activities. 

Thank you for that service. 

Our third witness, Wayne Murphy, is currently an assistant di- 
rector at the FBI. He joined the bureau with more than 22 years 
of service at the National Security Agency in a variety of analytic, 
staff and leadership positions. The bulk of his career assignments 
have involved direct responsibility for SIGINT analysis — that is 
signals intelligence analysis and reporting — encompassing a broad 
range of targets. 

Without objection, the witnesses' full statements will be inserted 
in the record, and I would ask each witness to summarize your 
statements. 
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I think this time clock is visible to you, or I think it can be, or 
there is a time clock that is visible to you. And we will get right 
into questions following your testimony. 

Thank you. 

We recognize you first, Dr. Morris. Dr. Morris, we are recog- 
nizing you first. I am not sure why we are doing that, but that is 
what we are doing. 

Mr. MORRIS. Didn't realize I was going to go first, but I will be 
very happy to do that. 

Ms. Harman. Dr. Morris, you are relieved of going first. 

[Laughter.] 

Mr. Morris. Thank you. 

Ms. HARMAN. Because this chair, who must be visually impaired, 
skipped the top of the statement. 

Ambassador McNamara, you are recognized first. I think that 
does make more sense, because you are going to present the infor- 
mation, and then we will follow on with two people who will com- 
ment on it, which seems obvious. I apologize for the confusion. 

STATEMENT OF AMBASSADOR THOMAS E. McNAMARA, 
PROGRAM MANAGER, INFORMATION SHARING ENVIRON- 
MENT, OFFICE OF THE DIRECTOR OF NATIONAL INTEL- 
LIGENCE 

Mr. McNamara. Thank you very much, Madam Chair. 

Chairman Thompson, Madam Chairman Harman, Ranking Mem- 
ber Reichert and members of the subcommittee, it is a great pleas- 
ure to be here with my colleagues today. And I want to thank you 
for the continued focus and priority for building an effective infor- 
mation sharing environment that you and the committee have 
shown over the course of many months. 

I hope to especially discuss with you all work on the presidential 
priority to standardized sensitive but unclassified information. 

Our current efforts to provide the president recommendations for 
standardizing SBU procedures, sensitive but unclassified, have 
been successful because of the strong interagency commitment that 
we have found. I want to note that Wayne Murphy, who is a mem- 
ber of the SBU Coordinating Committee with me, has been a part 
of this process since the very beginning and, with his colleagues in 
the Department of Justice and the FBI, have been instrumental in 
bringing the state, local and private sector perspectives and con- 
cerns to the table. 

I also was hoping to thank Colonel Bart Johnson were he here 
today, but I will thank him in his absence. He is the chair of the 
Criminal Intelligence Coordinating Council of Global Justice Infor- 
mation Sharing Initiative. He has been giving so much of his time 
and expert advice to our group, and I join the committee in offering 
our condolences to the family of the slain officer and to Colonel 
Johnson and his colleagues. 

I have a personal sense of this loss. My son is a law enforcement 
officer and has been in a situation that occurred in the last 24 
hours himself. 

Also, I would like to thank assistant commissioner for the Flor- 
ida Department of Law Enforcement, Mark Zadra, who is here 
today, who was our host at the very first national conference on fu- 
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sion centers, which was held earlier this year in Florida. It was an 
excellent, very astonishing, in some respects, conference. Over 600 
people came to that conference. They closed the rolls for the con- 
ference about 3 or 4 weeks before the conference began. 

When I showed up in this job a year ago, if someone had told me 
in a year that that would happen, I would have said, "Well, you 
people are just overly optimistic." And I think that shows how far 
things have gone over the course of the last few years. 

Finally, I want to note that the Department of Justice and De- 
partment of Homeland Security were leaders in the initial effort to 
research this issue on SBU and to collect the information on which 
my committee has been working these last 6 months. 

The lack of government-wide standards for SBU information is 
well known. More difficult has been charting a feasible way ahead 
to create such standards as part of a single regime. Over the years, 
because SBU is not considered a matter of national security con- 
cern, there has been no single control framework that enables the 
rapid and routine flow of this type of information. 

Throughout the Cold War, executive branch agencies and Con- 
gress responded in a piecemeal fashion, an uncoordinated way, to 
protecting SBU. It was left to each agency to decide on its control 
regime. 

For example, there are close to 107 unique markings and more 
than 131 different labeling or handling processes and procedures 
for SBU information. These markings and handling processes stem 
from about 280 statutory provisions and approximately 150 regula- 
tions. 

Protecting information and sharing information are critical and 
interdependent functions for the information sharing environment. 
Simply stated, sensitive information will not be shared unless par- 
ticipants have confidence in the framework protecting that infor- 
mation. 

Standardizing SBU procedures is a difficult endeavor made more 
complicated by the complex information management policies and 
practices which the government now has. Correcting these defects 
is especially important because some categories of SBU truly re- 
quire controls as strong as those for national security information. 

There are sound reasons in law and policy to protect those cat- 
egories from public release, both to safeguard the civil liberties and 
legal rights of U.S. citizens and to deny the information advantage 
to those who would threaten the security or the public order of the 
nation. 

Appropriately protecting law enforcement and homeland security 
related sources and methods, for example, are just as valuable to 
our nation as protecting our intelligence sources and methods. The 
global nature of the threat our nation faces today requires that our 
entire network of defenders be able to share information more rap- 
idly and confidently so that those who much act have the informa- 
tion they need to act. 

This lack of a single rational standardized and simplified SBU 
framework is a major cause of improper handling. It heightens risk 
aversion and undermines the confidence in control mechanisms. 
These problems are endemic within the federal government be- 
tween federal and non-federal agencies and with the private sector. 
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This is a national concern because the terrorist threat to the nation 
requires that many communities of interest, at different levels of 
government, share information. 

Ms. Harm AN. Ambassador McNamara, let me suggest that you 
just describe the new system, and we can get into the arguments 
for it and so forth in the question period, because your 5 minutes 
has expired. 

Mr. McNamara. Okay. I will then move to saying that I think 
this new system will enhance our ability to share vital information 
at the state, federal, local, tribal and private sector entities and 
also with our foreign partners. 

There are three major elements to the standardized SBU system 
that I am proposing. First, is the CU designation. The committee 
has decided that a clean break with the current SBU system would 
begin by calling it, controlled, unclassified information, CUI, thus 
eliminating the old term of SBU and any residual or legacy con- 
trols and habits that have grown up. 

Secondly, CUI markings, there will be a CUI framework rec- 
ommended that also contains mandatory policy and standards for 
making safeguarding and dissemination of all CUI originated at 
the federal government level and shared in the ISE regardless of 
the medium used for its display, storage or transmittal. This 
framework includes a very limited marking schema that addresses 
both safeguarding and dissemination. 

Thirdly, there will be CUI governance recommended. A central 
management and oversight authority in the form of an executive 
agent and an advisory council would govern the new CUI frame- 
work and oversee its implementation. This CUI framework is one 
of the essential elements among many elements that make up the 
ISE. 

And since my time is short and over, I guess, I will say that I 
would like to close by saying how helpful and important it is to the 
work that I am doing for the Congress to focus on this matter, as 
this committee and subcommittee has done. This is a high-priority 
matter creating the ISE and in particular it is important that the 
amount and quality of the collaboration on implementing these re- 
forms be noted and enhanced so that we can strengthen our 
counterterrorism mission at all levels of government. 

Thank you. 

[The statement of Mr. McNamara follows:] 

Prepared Statement of Abassador Thomas E. McNamara 



L Introduction 

Chairwoman Harman, Ranking Member Reichert, and Members of the sub- 
committee: I am pleased to be here with my colleagues and want to thank you for 
your continued focus and priority to building an effective Information Sharing Envi- 
ronment (ISE). 

As you and the Committee address classification of information issues, I would 
like to update you on a Presidential priority to standardize procedures for Sensitive 
But Unclassified (SBU) information. This is a priority because if we do not have a 
manageable SBU framework, we will not have an effective ISE. 

Information vital to success in our protracted conflict with terrorism does not 
come marked "terrorism information"; it can and does come from many sources, in- 
cluding from unclassified information sources. Yet we lack a national unclassified 
control framework that enables the rapid and routine flow of information across 
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Federal agencies and to and from our partners in the State, local, tribal and private 
sectors. This is especially important because some categories of unclassified inform a 
tion require controls as strong as those for national security information. There are 
sound i"easons to protect those categories from public release, both to safeguard the 
civil liberties and legal rights of U.S. citizens, and to deny the information advan- 
tage to those who threaten the security or public order of the nation. 

This lack of a single, rational, standardized, and simplified SBU framework is a 
major cause of improper handling. It heightens risk aversion and undermines con- 
fidence in the control mechanisms. This leads to both improper handling and unwill- 
ingness to share information. These problems are endemic within the Federal gov- 
ernment, between Federal and non Federal agencies and with the private sector. 
This is a national concern because the terrorist threat to the nation requires that 
many communities of interest, at different levels of government, share information. 
They must share because they have each have important responsibilities in coun- 
tering terrorism. The problem exists at all levels — -Federal, State, local, tribal, and 
the private sector. All have cultures that are traditionally cautious to sharing their 
sensitive information, but this must be addressed if we are to properly and effec- 
tively share sensitive but unclassified information. Only when the Federal govern- 
ment provides credible assurance that it can protect sensitive data from unauthor- 
ized disclosure through standardized safeguards and dissemination controls will we 
instill confidence that sensitive information will be appropriately shared, handled, 
safeguarded, and protected, and thus make sharing part of the culture. 

//. The Current SBU Environment 

Let me note at the outset that I will focus here on "unclassified" information. 
Classified information is, by law and regulation, controlled separately in a single 
system that was established early in the Cold War years. The classification regime, 
currently governed by Executive Order 12958, as amended, applies to "national se- 
curity information," which includes intelligence, defense, and foreign policy informa- 
tion. Other information, which legitimately needs to be controlled, is controlled by 
agency specific regimes. Collectively, these regimes address information referred to 
as Sensitive But Unclassified (SBU) information. SBU information has grown hap- 
hazardly over the decades in response to real security requirements, but this infor- 
mation cannot be encompassed in the subject specific classified control regime. The 
result is a collection of control mechanisms, in which most participants have con- 
fidence only when information is shared within an agency and sometimes not even 
then. 

Let me give you some understanding of how complex SBU is; Among the 20 de- 
partments and agencies we have surveyed, there are at least 107 unique markings 
and more than 131 different labeling or handling processes and procedures for SBU 
information. Even when SBU information carries the same label marking (e.g. For 
Official Use Only), storage and dissemination are inconsistent across Federal agen- 
cies and departments. Because such markings are agency specific, recipients of SBU 
information in a different agency must understand the processes and procedures of 
the originating Federal agency for handling the information, even if their agency 
uses the same marking. The result is an unmanageable collection of policies that 
leave both the producers and users of SBU information unable to know how a piece 
of information will be controlled as it moves through the Federal government and 
theref ore reducing information sharing. 

I would like to highlight just two examples to convey the confusion created by the 
current SBU processes: 

The first example is a single marking that is applied to different types of informa- 
tion. Four agencies (DHS, DOT, USDA and EPA) use "SSI" to mean "Sensitive Secu- 
rity Information." However, EPA has also reported the use of "SSI" to mean "Source 
Selection Information" (i.e. acquisition data). These types of information are com- 



ments, but still carry the same SBU marking acronym. In the same way, HHS and 
DOE use "ECI" to designate "Export Controlled Information," while the EPA uses 
"ECI" to mean "Enforcement Confidential Information." "Export Controlled Informa- 
tion" and "Enforcement Confidential Information" are clearly not related, and in 
each case, very different safeguarding and dissemination controls are applied to the 
information The second example is of a single marking for the same information, 
but with no uniformity in control. Ten agencies use the marking "LES" or "Law En- 
forcement Sensitive." However, the term is not formally defined by most agencies 
nor are there any common rules to determine who can have access to "law enforce- 
ment information." Therefore, each agency decides by itself to whom it will dissemi- 
nate such information. Thus, an individual can have access to the information in 
one agency but be denied access to the same information in another. Further con 
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fusing the situation, SBU markings do not usually indicate the originating entity. 
As a result, even if a recipient had access to all the different control policies for each 
agency, he or she could probably not determine what rules apply because the recipi- 
ent usually does not know which agency marked the document. 

Protecting the sharing of information is a critical and interdependent function for 
the ISE. Simply stated, sensitive information will not be shared unless participants 
have confidence in the framework controlling the information. Standardizing SBU 
procedures is a difficult endeavor, made more complicated by the complex informa- 
tion management policies. 

///, Unci as si fled Information Framework Imperative 

Producers and holders of unclassified information which legitimately needs to be 
controlled must have a common framework for protecting the rights of all Ameri 
cans. In the classified arena, we deal with information that will, mainly, be withheld 
from broad release. In the unclassified arena, we deal with information that is 
mainly shareable, except where statute and policy require restrictions. Agencies 
must often balance the need to share sensitive information, including terrorism-re- 
lated information, with the need to protect it from widespread access. 

A new approach is required. Existing practices and conventions have resulted in 
a body of policies that confuse both the producers and users of information, ulti- 
mately impeding the proper flow of information. Moreover, multiple practices and 
policies continue to be developed absent national standards. This lack of standards 
off en results in information being shared inappropriately or not shared when it 
should be. In December 2005, the National Industrial Security Program Policy Advi- 
sory Committee, described the consequences of continuing these practices without 
national standards in the following manner ", , .the rapid growth, proliferation and 
inclusion of SBU into classified contract requirements without set national stand- 
ards have resulted in pseudo security programs that do not produce any meaningful 
benefit to the nation as a whole." Clearly this situation is unacceptable. 

IV, A Presidential Priority 

The lack of government wide standards for SBU inf ormation is well known. More 
difficult has been charting a reasonable way ahead to create such standards. This 
is an enormously complex task that requires a careful balance between upholding 
the statutory responsibilities and authorities of individual departments and agen- 
cies, and facilitating the flow of information among them all the while protecting 
privacy and civil rights. We were successful in creating such a regime for classified 
national security information by setting national standards and requiring that they 
be executed uniformly across the Federal government. In addition, we established 
a permanent governance structure for managing the classified information regime. 
A similar approach is necessary to establish an unclassified information regime, 
with standards governing controlled unclassified information. 

As required by the Intelligence Reform and Terrorism Pi*evention Act of 2004, on 
December 16, 2005, the President issued a Memorandum to the Heads of Executive 
Departments and Agencies on the Guidelines and Requirements in Support of the 
Information Sharing Environment, which specified tasks, deadlines, and assign- 
ments necessary to further the ISE's development. Guideline 3, of his Memorandum, 
specifically instructed that to promote the sharing of, . .Sensitive But Unclassi- 
fied (SBU) information, including homeland security information law enforcement 
information, and terrorism information, 1 procedures and standards for designating, 
marking, and handling SBU information (collectively "SBU procedures") must be 
standardized across the Federal government. SBU procedures must promote appro- 
priate and consistent safeguarding of the information and must be appropriately 
shared with, and accommodate and reflect the imperative for timely and accurate 
dissemination of terrorism information to, State; local, and tribal governments, law 
enforcement agencies, and private sector entities." 

An interagency SBU Working Group, co chaired by the Departments of Homeland 
Security (DHS) and Justice (DOJ), undertook an intensive study and developed sev- 
eral draft recommendations for a standardized approach to the management of SBU. 
Its work provided a solid foundation for completing the recommendations. It was de- 



1 Pursuant to the ISE Implementation Plan, and consistent with Presidential Guidelines 2 and 
3, the ISE will facilitate the sharing of "terrorism information," as defined in IRTPA section 
1016(aX4)> as well as the following categories of information to the extent that they do not other 
wise constitute "terrorism inf ormation": (1) homeland security information as defined in Section 
892(f)(1) of the Homeland Security Act of 2002 (6 U.S.C. § 482(f)(1)); and (2) law enforcement 
information relating to terrorism or the security of our homeland. Such additional information 
includes intelligence information. 
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ter mined, however, that additional work was necessary to fully meet the require- 
ments of Guideline 3. 

Recommendations for Presidential Guideline 3 are coming close to completion in 
a SBU Coordination Committee (SBU CC), chaired by the Program Manager, Infor- 
mation Sharing Environment (PM ISE), with Homeland Security Council oversight. 
The SBU CC began work in October 2006 with the participation of the Departments 
of State, Defense, Transportation, Energy, Justice, and Homeland Security; the Fed- 
eral Bureau of Investigation; the Office of the Director of National Intelligence; the 
National Security Council; and the Office of Management and Budget. The com- 
mittee actively consults with representatives from other departments and agencies, 
the National Archives and Records Administration (NARA), the Information Secu- 
rity Oversight Office, the Controlled Access Program Coordination Office, the Infor 
mation Sharing Council, the Global Justice Information Sharing Initiative, State, 
local, and tribal partners, and several private sector groups. 

The efforts of the SBU CC have focused on developing an SBU control framework 
that is rational, standardized, and simplified, and as such, facilitates the creation 
of an ISE that supports the individual missions of departments and agencies and 
enhances our ability to share vital terrorism information among Federal, State, 
local, tribal, and private sector entities, and foreign partners. 

• Rationalization means establishing a framework based on a set of principles 
and procedures that are easily understood by all users. This should help build con- 
fidence among users and the American public that information is being shared and 
protected in a way that properly controls information that should be controlled, and 
protects the privacy and other legal rights of Americans. 

• RATIONALIZATION means structuring a framework in which all participants are 
governed by the same definitions and procedures and that these are uniformly ap- 
plied by all users. The objective is to end uncertainty and confusion about how oth- 
ers using the framework will handle and disseminate SBU information. Standard- 
ization helps achieve the ISE mandated by Congress: "a trusted partnership be- 
tween all levels of government." 

• Simplification means operating a framework that has adequate, but carefully 
limited, numbers and types of markings, safeguards, and dissemination of SBU in- 
formation. Such a simplified framework should facilitate Federal, State, and local 
government sharing across jurisdictions; facilitate training users; and reduce mis- 
takes and confusion. 

V. The Controlled Unclassified Information (CUI) Framework 

I must reiterate that interagency discussions of a proposed detailed framework 
are still underway. Furthermore, no recommendation will become final unless and 
until it is approved by the President. Of course, the ability to implement any reform 
will depend upon the availability of appropriations. With respect to the present pro- 
posal, however there is general agreement that the SBU framework should include 
the following 6 main elements: 

1. CU I Designation: To ensure a clean break with past practices, the Framework would change 
the descriptor for this information to "Controlled Unclassified Information" (CUD thus eliminating the 
old term "SBU." Participants would use only approved, published markings and controls, and these 
would be mandatory for all CUI information. All other markings and controls would be phased out. 

2. CUI Mmarkings: The CUI Framework also contains mandatory policies and standards for 
marking, safeguarding and dissemination of ail CUI originated by the Federal government and shared 
within the ISE, regardless of the medium used for its display, storage, or transmittal. This Framework 
includes a very limited marking schema that addresses both safeguarding and dissemination, it also 
provides reasonable safeguarding measures for all CUI, with the purpose of reducing the risk of unau- 
thorized or inadvertent disclosure and dissemination levels that with the purpose of facilitating the 
sharing of CUI for the execution of a lawful Federal mission or purpose. 

3. CUI Executive Agent: A central management and oversight authority in the form of an 
Executive Agent would govern the new CUI Framework and oversee its implementation. 

4. CUI Council: Federal departments and agencies would advise the Executive Agent through 
a CUI Council composed of senior agency officials. The Council will also create mechanisms to solicit 
State, local, tribal, and private-sector partner input. 

5. Role of Departments anb Agencies: The head of each participating Federal depart- 
ment and agency wilt be responsible for the implementation of a functional CUI Framework within 
the agency. 

6. CUI Transition Strategy a Transition Strategy for a phased transition from the current 
SBU environment to the new CUI Framework is needed. During the transition, special attention would 
be paid to initial governance, performance measurements, training, and outreach components. 

On a final note, our work has recognized that the substantive information that 
will be marked and disseminated in accordance with the proposed Framework is 
also subject to a variety of other legal requirements and statutes. Among some of 
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the most important statutes and legal authorities that apply to this information are 
the Privacy Act of 1974, the Freedom of Information Act, the Federal Information 
Security Management Act (FISMA) and various Executive Orders, including Execu- 
tive Order 12333, which governs the Intelligence Community and its use of United 
States Persons information. I would like to stress that this proposed Framework for 
handling SBU has thoroughly considered these legal authorities and does not alter 
the requirements and obligations imposed by these authorities. We will continue to 
work with the ISE Privacy Guidelines Committee to ensure that the appropriate pri- 
vacy issues fully meet any legal requirements to protect the civil liberties and pri- 
vacy of Americans. 

VI. Conclusion 

For information sharing to succeed, there must be trust the trust of government 
providers and users of information, or policymakers, and most importantly, of the 
public. Each of these must trust that information is being shared appropriately, con- 
sistent with law, and in a manner protective of privacy civil liberties. Building trust 
requires strong leadership, clear laws and guidelines, and advanced technologies to 
ensure that information sharing serves important purposes and operates consistently 
with American values. 2 

The lack of a single, rationalized, standardized, and simplified SBU framework 
does contribute to improper handling or over-classification. To instill confidence and 
trust that sensitive information can be appropriately shared, handled, safeguarded, 
and protected, we must adopt a standardised CUI Framework. This is especially 
critical to our counterterrorism partners outside the intelligence community. Appro- 
priately protecting law enforcement and homeland security related sources and 
methods are just as valuable to our national security as protecting our intelligence 
sources and methods. 

The global nature of the threats our Nation faces today requires that: (1) our Na- 
tion's entire network of defenders be able to share information more rapidly and 
confidently so that those who must act. have the information they need, and (2) the 
government can protect sensitive information and the information privacy rights 
and other legal rights of Americans. The lack of a government-wide control frame 
work for SBU information severely impedes these dual imperatives. The CUI 
Framework is essential for the creation of an ISE which has been mandated by the 
President and the Congress. Only then can we meet the dual objectives of enabling 
our Nation's def enders to share inf ormation effectively, while also protecting the in- 
formation that must be protected. A commitment to achieving standardization is es 
sential a vital need in the post 9/11 world. 

Ms. HARMAN. Thank you, Ambassador. 

We now recognize Dr. Morris for a 5-minute summary. 

STATEMENT OF CARTER MORRIS, Ph,D., DIRECTOR, 
INFORMATION SHARING AND KNOWLEDGE MANAGEMENT, 
OFFICE OF INTELLIGENCE AND ANALYSIS, DHS 

Mr. Morris. Thank you, Madam Chairman, Chairman Thomp- 
son, Ranking Member Reichert, other distinguished members of the 
subcommittee. 

It really is a pleasure for me to be here this morning to talk 
about the activities that we are doing in DHS relative to informa- 
tion sharing and specifically to talk about the activities that we are 
doing with Ambassador McNamara, the FBI, our other federal 
partners and our state and local partners in developing a system 
that will effectively allow us to share information but also to pro- 
tect the information that needs to be protected. 

When I go around and give my various talks that I give on infor- 
mation sharing, I like to quote from the Homeland Security Act 
that says one of the responsibilities of DHS is to share relevant 
and appropriate homeland security information with other federal 
agencies and appropriate state and local personnel together with 



^Mobilizing Information to Prevent Terrorism: Accelerating Development of a Trusted In for ma 
Hon Sharing Environment, Third Report of the Markle Foundation Task Force, July 2006 
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assessments of the credibility of such information. And the act de- 
fines state and local to include the private sector. 

I think that is my charge in DHS to make that happen and that 
we take that very seriously that that is a major part of the respon- 
sibilities of the Department of Homeland Security. 

The challenge that we face, and the one we are talking about 
here today, is the issue that being able to share but to still protect 
the information that needs to be protected. Now, I know from the 
Congress we hear both things coming at us strongly, and we want 
to make sure that we do both effectively. 

In the national security community, we have had a classification 
system in place for a very long time. You can argue as to what is 
in it and what is out of it, but let me assure you, even in that com- 
munity, we continue to look at need to know and originator control 
and third agency rules, all the things that people believe are an im- 
pediment to sharing, all of which are actively being debated at the 
moment. 

Outside of the national security community, as we have already 
talked about, there are also reasons to protect information. Some 
of this information is very vital to national security — privacy, law 
enforcement case information, witness protections, security prac- 
tices, vulnerabilities in our critical sectors and even lots of others. 

These are very legitimate reasons, and what we have to do is fig- 
ure out how to share, how to protect and how to build trust in the 
system, as Ranking Member Reichert pointed out, so that people 
will actually share the information. And that is the challenge that 
we have. 

Let me add a little bit of my own personal assessment here, 
speaking for myself. As I look around the information sharing busi- 
ness, information that is what I would call important is rarely not 
protected in some way. So in almost everything we talk about in 
information sharing, we have to couple that with a discussion of in- 
formation protection. And so we can't talk about one without the 
other. 

We believe that DHS has moved forward in the information shar- 
ing business. If you look at my written statement, you will see that 
there are a number of references made, the things we have done. 
I would like to point out just two, and one of them is very relevant 
today. 

One is, in the classified domain, we have led a community effort 
with all of our partners to look at how we better produce unclassi- 
fied tear lines from classified reporting and to not only produce 
that tear line with information but produce an assessment, let me 
say, of the credibility of that information. We believe we have a 
new system that is currently being implemented, and some of my 
intelligence community partners we have already seen a real 
change in how that is being implemented. 

The second area on the non-classified side is all of the efforts 
that we have put into working the controlled, unclassified informa- 
tion. As Ambassador McNamara said, DHS, working with the De- 
partment of Justice, that really started that planning into these ac- 
tivities, and we take this as a very important thing to accomplish. 
Some of the people who work for me are very rabid about the issue 
that we really do need to get this under control and do it very well. 
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So that is the area that we really need to work on, this regime 
for how we handle and control information. 

Let me say that when we do this regime of looking at how this 
controlled, unclassified information, we believe there are three 
things that we particularly need to pay attention to. One is that 
we put in place a governance structure to run this, and we put it 
in quickly, effectively and from the beginning. 

The second thing is we believe any system is going to have to be 
easy to use. It is going to have to be convenient. 

And the third thing is that we believe that we are going to have 
to make sure that any system that we put in at the federal level 
is closely coordinated with the state and locals and how they han- 
dle information. As we know, there is law enforcement information 
at the federal level, there is law enforcement information at the 
state level. They are controlled differently, and we need to bring 
those systems together. 

Let me finish up then, since my light is on, and very quickly. 
One, we are dedicated to information sharing. We are dedicated to 
implementing a new system to run the controlled, unclassified in- 
formation. We are very much on board with the program and the 
proposal that is currently being proposed. 

However, I will say, I do not believe this is easy. It is not easy 
at all, and I think that we are going to have to pay particular at- 
tention. We believe the phased approach that is in the initial pro- 
posal and how to get into this, we believe, is the right proposal. 

And I am here now to answer any questions that you might like 
to ask. 

[The statement of Mr. Morris follows:] 

Prepared Statement of Dr. Carter Morris 
April 26, 2007 

Good morning, Chairwoman Harman, Ranking Member Reichert, and distin- 
guished members of the subcommittee. My name is Carter Morris, and I am the Di- 
rector of Information Sharing and Knowledge Management for the Office of Intel 
ligence and Analysis at the Department of Homeland Security (DHS). It is a pleas- 
ure to be with you today to discuss the control of government information and the 
actions DHS is taking to address and improve our ability to share information with 
out unnecessary restrictions and in a manner that protects what needs to be pro- 
tected. 

The Homeland Security Act of 2002 authorizes DHS to access, from any agency 
of the Federal government, state, local, and tribal governments, and the private sec- 
tor, all information relating to threats of terrorism against the United States and 
other areas; information relating to the vulnerabilities of the United States to ter- 
rorism; and information concerning the other responsibilities of the Department as 
assigned to and by the Secretary. After analyzing, assessing, and integrating that 
information with other information available to DHS, the Secretary must then en- 
sure that this information is shared with state, local, and tiibal governments; and 
the private sector, as appropriate. Concomitant with these responsibilities is the ob- 
ligation of the Secretary to identify and safeguard all homeland security inf ormation 
that is sensitive, but unclassified, and to ensure its security and confidentiality. In- 
formation sharing, for counterterrorism and related purposes, therefore, is key to 
the mission of DHS. 

Moreover, the Intelligence Reform and Terrorism Prevention Act of 2004 estab- 
lished the Program Manager of the Information Sharing Environment (PM ISE) to 
assist in the development of policies, procedures, guidelines, rules, and standards, 
including those which apply to the designation, marking, and handling of sensitive 
but unclassified information, to foster the development and proper operation of the 
ISE. DHS, in coordination with the PM ISE and other agencies on the Information 
Sharing Council, is actively participating in efforts to standardize procedures for 
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sensitive but unclassified information and create an effective Information Sharing 
Environment. . 

The Challenge 

The challenge that we face in handling information is balancing two important 
and competing factors: "sharing the information that needs to be shared" and "pro 
tecting information that needs to be protected." Our goal is to share information un- 
less there is a valid and necessary reason to protect such information and thus limit 
or control the dissemination to a discrete community or other set of users. 

The legitimate need to classify some information, for purposes of national security 
and to protect our sources and methods and allow information collection operations 
to be conducted without advanced notice to our adversaries, is well established. As 
sources and methods for acquiring information change, as well as our adversaries 
capabilities, we continue to evaluate and adjust our classification criteria. 

Similarly, there are many indisputably legitimate reasons for protecting certain 
unclassified information, which we refer to generically as Controlled Unclassified In- 
formation (CUI)— for example, privacy concerns relating to personal information, the 
danger of compromising ongoing law enforcement investigations or of endangering 
witnesses, the need to protect private sector proprietary information and, most im- 
portantly, the need to protect information containing private sector vulnerabilities 
and other security-related information that could be exploited by terrorists. Unau- 
thorized disclosure of this information could cause injury to a significant number of 
individual, business, or government interests. 

Through DHS's work with state and local fusion centers, we have encountered ex- 
amples of how the proliferation of internal policies for handling unclassified but sen- 
sitive information can create unintended barriers to information sharing. Existing 
markings that are meant to identify necessary safeguards and dissemination restric- 
tions on information often create as much confusion as help. For example, a state 
fusion center received a report that contained actionable threat information bearing 
the marking "LES", meaning Law Enforcement Sensitive. The fusion center per- 
sonnel were unsure to what extent they could disseminate information with such 
a marking. When they contacted the originating Federal agency, they wei*e unable 
to speak with someone who knew the data and could explain the disclosure rules. 
The fusion center personnel erred on the side of caution and did not share the infor- 
mation in this case not the best solution. 

Sensitive information (classified or unclassified) is only shared by people who 
trust the systems, policies, and procedures that guide that sharing. Any lack of con- 
fidence regarding the operation and effectiveness of a system reduces the willing- 
ness of consumers to share the information, therefore limiting any benefits it might 
offer. 

With that in mind, we continue working to transition from a historically risk 
averse approach to sensitive information sharing, to one whei"e the risks are consid- 
ered and managed accordingly, but consistent with a responsibility to provide infor- 
mation to our partners and customers who need it. 

In order to implement the mandates of the Information Sharing Environment we 
must both produce material at the lowest sensitivity level appropriate to allow it 
to be easily shared with all who need it and ensure that processes for protecting 
information that needs to be protected are defined and effective. 

DHS is leading information sharing 

DHS has been a leader in establishing new approaches to information sharing — 
including federal sharing at all classification levels; sharing with our state, local, 
tribal, and territorial partners; and sharing with the private sector. In this sharing 
it is critical to address both operational needs and the appropriate security in trans- 
ferring the information. I would like to talk about five specific DHS information 
sharing initiatives where we are addressing the need to share but still providing an 
appropriate level of control of this information. 

1. Like other Federal departments and agencies, DHS shares infoimation with 
state, local, and tribal partners through state and local fusion centers. We are pro- 
viding people and tools to these fusion centers to create a web of interconnected in- 
formation nodes across the country that facilitates the sharing of information to 
support multiple homeland security missions. Working with the Federal government 
and its partners to establish this sharing environment, DHS is ensuring that its 
processes and systems not only achieve the sharing necessary but also provide the 
protection and control of the information that gives all parties confidence and trust 
that the information is appropriately used and that information which needs to be 
protected such as personally identifiable information is appropriately controlled 
and protected. 
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2. DHS, DOJ and other federal entities are also creating a collaborative, unclassi- 
fied information sharing community, based on establishing a t usted partnership be- 
tween the fusion centers and the federal government. This environment is require- 
ments driven, and focused on providing information to support the mission of the 
intelligence analysts, allowing both information sharing and collaboration with the 
state and local intelligence communities to encourage the development of mature in- 
telligence fusion capabilities. A key to the development of such a sharing environ- 
ment is providing a system and processes that build confidence that information will 
not only be shared but also protected and controlled as needed, which is what we 
are doing. 

3. As part of the Presidential Guideline effort, DHS led an interagency working 
g oup that developed the "Recommended Guidelines for Disseminating Unevaluatea 
Domestic Threat Tearline Reporting at the Unclassified Level." Federal agencies 
disseminate unclassified extracts from unevaluated classified threat reports to facili- 
tate sharing of threat information with those on the domestic front lines. Federal 
dissemination of raw threat reporting to State and local authorities before the rel- 
evant Federal agencies can assess the specific threat has, at times, led State and 
Local autho ities to misinte pret the credibility of the threat. This effort provided 
recommendations to support timely sharing of terrorist threat data with state and 
local officials with increased clarity on the credibility of the information while main- 
taining the appropriate security for sources and methods. These recommendations 
are now being implemented in the intelligence community. 

4. DHS is also leading the Federal Coordinating Group, to create coordinated fed- 
eral intelligence p oducts at the lowest appropriate levels of classification, for dis- 
semination to state, local, tribal and private sector communities. The Group will co- 
ordinate three categories of "federally coordinated terrorism information products"— 
time-sensitive threat/incident reporting, situational awareness reporting, and stra- 
tegic or foundational assessments. For each category of products, the Group will en- 
sure originating agencies validate sourcing, ensure substantive completeness, and 
tailor the analysis for state, local, tribal, and private sector use. The Group will co- 
ordinate the downgrading and/or "tear lining" of classified materials where appro 
priate levels of classification or control that permit wider state, local, tribal, and pri- 
vate sector use but do not jeopardize national security or other sensitivities. Again 
the key is proWding the necessary information while also providing clear under- 
standing of the necessary protection and control of this information. 

5. And finally, DHS is active in the interagency group working to minimize the 
number of different CUI safeguard and dissemination requirements. We undertake 
these efforts with an eye toward facilitating appropriate information sharing and 
significant progress can be made by eliminating internal safeguarding and dissemi- 



casionally overly protective of information. We are committed to developing a system 
for Controlled Unclassified Information that effectively facilitates sharing while at 
the same time protecting sensitive inf ormation that requires robust protection. 

DHS Key CUI elements 

There are three issues that we believe are critical to success in instituting an ef- 
fective CUI framework. 

First, an effective and continuing CUI governance structure must be established. 
The lack of a government wide governance structure is one of the primary reasons 
that we have been struggling to overcome confusion in this area. To advance the 
government's information sharing demands with the attendant need to appro- 
priately safeguard sensitive information requires a permanent governance structure 
to oversee the administration, training, and management of a standardized CUI sys- 
tem. 

Second, DHS believes that the improved CUI framework must be clear and easy 
to implement for all stakeholders. It is important that we can justify and defend 
all information that is so controlled. If the framework is not readily understood it 
will not be used. Furthermore, adoption must be swift;. Establishing the governance 
structure will aid this process by documenting the ules and standardizing the poli- 
cies, processes, and procedures for handling CUI across the federal government. 

And third, we must ensure that all potential users of CUI have a clear under- 
standing of the CUI framework so that we can facilitate a more effective and inter- 
active information exchange. We understand that they have their own constraints 
surrounding systems and sensitive data, so we must work to identify mechanisms 
to integrate state and local systems with the Federal framework. 

Addressing these elements will help provide transparency and build confidence to 
increase sharing across communities from intelligence to law enforcement, from 
law enforcement to the first responders, etc. 
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Challenges Facing CUI standardization 

Over 100 CUI designators or markings have been identified, and each of these has 
arisen to address a valid need to protect information. Most are codified as internal 
policies and procedures, some of which have actually seived to enhance information 
sharing, i.e., clearly defined control systems create a trusted environment that en- 
courages information sharing. Less often, such designators or markings are the re- 
sult of legislative and/or regulatory requirements to protect certain information in 
a particular way. These practices worked well within a local environment, but the 
challenge is to leverage the successful practices and build a trusted environment 
that bridges communities and domains. We must exercise caution, however, as we 
go forward to consider and, where appropriate, revise operational practices in a 
manner that can achieve both sharing and protection in an expanded community. 

This caution is especially true in cases where controls were created more to facili- 
tate, rather than limit, information sharing. Within DHS, there are three such infor- 
mation protection regimes— "Protected Critical Infrastructure Information (PCII)," 
"Sensitive Security Information (SSI)," and the newly established "Chemical Vulner- 
ability Information (CVI)." Congress mandated these categories of information be 
protected and DHS promulgated regulations implementing these regimes. Each was 
specifically created to foster private sector confidence to increase their willingness 
to share with the federal government crucial homeland security related information. 
To date, PCII and SSI have been successful in this regard and have been well-re- 
ceived by the private sector. Moreover, these designations are ready examples of 
how robust control of information can actually promote appropriate sharing. 

Summary 

Because we are changing established cultures and procedures and moving for- 
ward, in coordination with the PM ISE, with a new framework for CUI, it is impor- 
tant that we adequately address all elements of its implementation. Governance, 
training, strategic communications, information technology systems planning, and 
the development of new standards and procedures are all important to the effective 
implementation of these reforms. Phased implementation and continuous incorpora- 
tion of the lessons learned in this process are basic tenets of change management. 
It is important that the appropriate governance model is adopted to ensure system- 
atic implementation of the framework and foster information sharing. 

That said, DHS is fully committed to this new framework and is, moreover, 
pleased that the framework fully recognizes the difficulties of implementation by 
proposing, among other things, a planning phase and phased implementation. Doing 
so will allow a smoother implementation and reduce the risk of losing the confidence 
that non-federal partners have now found in current DHS programs. 

DHS looks forward to continue working with the PM ISE, the Information Shar- 
ing Council, and each of our Federal partners, to address the challenges of what 
many perceive to be the "over-classification" of information. We believe we made 
great strides in identifying the challenges. We also believe the paths forward are 
paved for interagency success in improving the sharing of information and providing 
an appropriate and streamlined system for controlling sensitive information. Never- 
theless, and notwithstanding the good progress we have made to date, we should 
not underestimate the challenges that exist for implementing a new system for 
standardizing and handling Controlled Unclassified Information across the Federal 
government. 

Thank you for your time. I would be glad to answer any questions. 
Ms. Harman. Thank you, Dr. Morris. 

The chair now recognizes Mr. Murphy for a 5-minute summary 
of his testimony. 

STATEMENT OF WAYNE M, MURPHY, ASSISTANT DIRECTOR, 
DIRECTORATE OF INTELLIGENCE, FEDERAL BUREAU OF 
INVESTIGATION 

Mr. Murphy. Good morning. Thank you, Madam Chairman Har- 
man, Chairman Thompson, Ranking Member Reichert and mem- 
bers of the subcommittee. 

I am pleased to be here today to demonstrate the commitment 
of the Federal Bureau of Investigation to strengthening our na- 
tion's ability to share terrorism information. We are diligently 
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working to fulfill the expectations that Congress set forth in the In- 
telligence Reform and Terrorism Prevention Act of 2004. 

As the assistant director for intelligence to the FBI and the FBI's 
senior executive for information sharing, I am at once responsible 
for, accountable to, and have a vested interest in a successful infor- 
mation sharing environment. 

I am particularly pleased to be testifying today with Ambassador 
Ted McNamara and Dr. Carter Morris. It has been my privilege 
over the past many months to work with these professionals and 
many others as we seek to craft an outcome that matches both the 
letter and spirit of the task before us, 

I join them today to discuss our collective efforts to develop a 
standardized framework for marking, safeguarding and sharing 
controlled, unclassified information. My nearly 24 years in the in- 
telligence community have largely been served in an environment 
where I dealt almost exclusively with classified national security 
information. 

While those regimes could be complicated and require great dis- 
cipline and attention to detail, by comparison, they are far less 
challenging than my experience has been in working to organize a 
functional CUI framework. This is not because of a lack of commit- 
ment, focus and creativity and trying to address that framework 
but because of the myriad of issues and interests that one encoun- 
ters in the transitional world of information between what is con- 
trolled and what is not. 

From an FBI perspective, getting it right is especially important. 
Our information sharing environment spans the range from classi- 
fied national security information to fully open source. We must 
have the capacity to interpose information from all of these regimes 
and to do so in a dynamic manner. We must have the agility to 
rapidly move information across security barriers and into environ- 
ments that make it more readily available and therefore of greater 
value to the broadest set of players. 

And across all of our partners, we must have a framework that 
allows for an immediate and common understanding of informa- 
tion's providence and the implications that that imparts. We must 
make the sharing of CUI a benefit, not a burden, especially on 
state, local and tribal police departments who would be dispropor- 
tionately affected if asked to sustain a complex and expensive con- 
trol framework. We must manage information in way that sustains 
the confidence of people and organizations who share information 
that puts them and their activities at risk. 

Most important of all, we must respect the power of that infor- 
mation and the impact it holds for the rights and civil liberties of 
American people who have trusted us to be its stewards. That 
means we must also never use control as a way to deny the public 
access to information to which they are properly entitled. 

With the FBI, achieving a streamlined CUI framework is much 
more than establishing a process; it is about shaping mindsets so 
that we can shift fully from a need to know to a duty to provide. 
The CUI framework, as proposed, creates opportunities and solves 
problems for me that I could not have solved on my own. The FBI 
is fully and completely committed to this process. 
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All of us who have been part of this process wish we could move 
more quickly in reaching a point where we are today, but I believe 
the investment of time, the level of effort and the openness and 
commitment that has marked our dialogue has done justice to the 
expectations of the American people. 

Thank you for this hearing. I look forward to answering your 
questions. 

[The statement of Mr. Murphy follows:] 

Prepared Statement of Wayne M. Murphy 
april 26, 2007 

Good morning, Chainnan Hannan, Ranking Member Reichert, and members of 
the Subcommittee. I am pleased to be here today to demonstrate the commitment 
of the Federal Bureau of Investigation (FBI) to strengthening our nation's ability 
to share terrorism information. We are diligently working to fulfill the expectations 
Congress set forth in the Intelligence Reform and Terrorism Prevention Act of 2004. 
As the Assistant Director for Intelligence and the FBI Senior Executive for Informa- 
tion Sharing, I am at once responsible for, accountable to and have a vested interest 
in a successful Information Sharing Environment. 

I am particularly pleased to be testifying today with Ambassador Ted McNamara, 
the Information Sharing Environment Program Manager, and Dr. Carter Morris, 
Director for Information Sharing and Knowledge Management, Intelligence and 
Analysis from the Department of Homeland Security. It has been my privilege over 
the past many months to work with these professionals and others as we seek to 
craft an outcome that matches both the letter and spirit of the task before us. 

I join them today to discuss our collective efforts to develop a standardized frame- 
work for marking, safeguarding, and sharing "Controlled Unclassified Information" 
(CUI), or as it is more commonly known, "sensitive but unclassified" information. 

On December 16, 2005, the President issued the "Guidelines for the Information 
Sharing Environment" as mandated by the Intelligence Reform and Terrorism Pre- 
vention Act of 2004. These Guidelines, among other things, set in motion a process 
for standardizing the handling of controlled unclassified information. 

My nearly 24 years in the intelligence community have largely been served in an 
environment where I dealt almost exclusively with classified national security infor- 
mation. While those regimes could be complicated and required great discipline and 
attention to detail, by comparison they are far less challenging than my experience 
has been in working to organize a functional CUI framework. This is not because 
of a lack of commitment, focus and creativity in trying to address that framework, 
but because of the myriad of issues and interests that one encounters in the transi- 
tional world of information between what is controlled and what is not. 

It is essential that we get it right, because it is information in this environment 
that can be of greatest utility when we need to share across a broad range of inter- 
ests and constituencies. This framework provides a measure of protection for sen- 
sitive information to reassure those who might seek to hold such information in a 
classified or overly restrictive regime, which would deny others access and cause us 
to fail on our "duty to provide." 

From an FBI perspective getting it right is essential. The Information Sharing 
Environment, which is the lifeblood of our mission, spans the range from classified 
national security information to fully open source. We must have the capacity to 
interpose information from all of these regimes and do so in a dynamic manner. We 
must have the agility to rapidly move information across security boundaries and 
into environments that make it more readily available and therefore of greater 
value to the broadest set of players. And across all of our partners, we must have 
a framework that allows for an immediate and common understanding of informa- 
tion's provenance and the implications that imparts. We must make the sharing of 
CUI a benefit, not a burden-^especially on State, Local and Tribal police depart- 
ments who would be disproportionately affected if asked to sustain a complex and 
expensive control framework. We must manage information in a way that sustains 
the confidence of people and organizations who share information that puts them 
at risk. Most important of all, we must respect the power of that information and 
the impact it holds for the rights and civil liberties of the American people who have 
entrusted us as its stewards. That also means that we must never use "control" as 
a way to deny the public access to information to which they are entitled. 
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For the FBI, achieving a streamlined CUI framework is much more than estab- 
lishing a process, it's about shaping mindsets so we can fully shift from "need to 
know' to "duty to provide." This shift does not diminish our responsibility to prop- 
erly protect the privacy lights and civil liberties of all Americans. It does not set 
up a framework that puts at greater risk our sources and methods and it. does not 
compromise our capacity to conduct both an intelligence and law enforcement mis- 
sion with full vigor and impact. Rather, this framework seeks to level the informa- 
tion sharing playing field through a common lexicon and a shared understanding 
of goals. 

Unfortunately, the present set of policies and practices make it extremely difficult 
for well meaning individuals to act responsibly, appropriately and completely in this 
regime. There are well over 100 separate markings for CUI and there is no easy 
way for the recipient of information bearing an unfamiliar marking to find out what 
that marking means. Moreover, the same marking means different things in dif 
ferent parts of the Federal Government. 

The FBI, working in close coordination with the Department of Justice, have joint- 
ly drawn upon the experience and the wisdom of state and local law enforcement 
personnel to help us understand better what kinds of CUI policies would be most 
helpful to them as we strive to share information without compromising either pri- 
vacy or operational effectiveness. The Criminal Intelligence Coordinating Council 
(CICC) of the Global Justice Information Sharing Initiative has played an active 
role in advising us on this matter, including the convening on December 6, 2006 for 
an all day meeting to discuss the practicability at the state and local level of various 
proposed "safeguards" for CUI. I would like to acknowledge here the particularly 
constructive role played by the CICC Chair, Col. Bart Johnson of the New York 
State Police. Col Johnson is forthright in explaining what Federal policies would be 
most helpful in enabling state and local law enforcement to play their part in pre- 
venting terrorism, but he is also sophisticated in his understanding of the many 
other factors that must be taken into account. 

In our view there are three aspects of the current draft framework that are par 
ticularly important: 

1. Every marking that appears on any CUI document in the future must have 
a clear and unambiguous meaning. There should be a website — -accessible over 
the Internet to everybody- -on which the approved markings are defined, and 
no markings should ever be used that are not defined on this website. This will 
mean that recipients of shared inf ormation who want to do the right thing will 
easily be able to find out what protective measures are expected of them. I be 
lieve that this change will both increase sharing and decrease the risks of shar 
ing. 

2. All CUI information must be marked with a standardized level of safe 
guarding. For most CUI this safeguarding will be no more than ordinary pru 
dence and common sense -^on't discuss CUI when you can be overheard by peo- 
ple you don't intend to share it with, store it in an access controlled environ- 
ment, as needed protect it with a password. 

3. All CUI information must be marked with appropriate dissemination guid 
ance so that i-ecipients can easily understand what further dissemination is per- 
mitted. 

All of us who have been part of this process wish we could have moved more 
quickly in reaching the point where we are today, but I believe the investment of 
time, the level of effort and the openness and commitment that has marked our dia- 
log has done justice to the expectations of the American people. 

Thank you f or time, I look forward to answering your questions. 

Ms. HARMAN. Thank you very much. We are impressed that 
there is a minute and a half left over. You win the prize, Mr. Mur- 
phy. 

[Laughter.] 

Well, I do apologize for rushing Ambassador McNamara. He has 
important things to tell us. But unless we adhere to this format, 
we don't give adequate time to ask questions and to respect the 
fact that we have a second panel of witnesses and also probably 
that we are going to have to recess for votes at some point during 
this hearing. 

Well, I thank you all for your testimony. 
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And I will now recognize myself for 5 minutes of questions, and 
I will strictly adhere to the time. 

Dr. Morris, I was sending DHS a message through you about 
frustration with the lack of progress on the ITACG and the inclu- 
sion of state, local and tribal representatives in the preparing of 
analytic products that is hopefully going to give those state, local 
and tribal authorities information they need in a timely way to 
know what to look for and what to do. 

Every terror plot is not going to be hatched in Washington, D.C. 
where we might have adequate FBI and federal resources at the 
ready. I don't believe that for a minute, and I know no one on this 
panel does. 

So I am sending this message that it is absolutely critical for 
DHS to spend more time supporting the inclusion of numerous 
state, local and tribal representatives in the ITACG and to stand 
up the ITACG promptly. We don't understand any reason for delay. 
I am speaking for myself. I have a feeling that the chairman is 
going to speak for himself shortly on this same issue. 

And the way to do it right is the way Ambassador McNamara, 
working with you and state and local and tribal authorities, has 
come up with this proposal. So there is a positive example to learn 
from, and I hope that DHS, through you, is going to learn. 

Are you going to learn? 

Mr. Morris. I think that we are all committed to bringing state 
and locals into this activity. I can tell you personally it has always 
been my objective to do that. I have a meeting with my staff this 
afternoon on how we do this. 

I think the challenge has been, the delay is that, in a sense, es- 
tablishing the infrastructure for doing this kind of thing is more 
challenging than we would all like to have, but there is no lack of 
commitment, and we will move forward aggressively. And that is 
what we are doing. 

Ms. HARMAN. Well, I hope that is true. Some of us thought that 
these folks could just be included in the NCTC itself, and then we 
were told we need a separate entity, Now you are saying setting 
up a separate entity has problems. I think the principle is the crit- 
ical piece, and so let's not create problems with the second entity 
if it is a problem. Let's just move forward on the principle. 

Mr. Morris. We agree. No, absolutely. 

Ms. Harman. Sure. Okay. 

Ambassador McNamara, I did rush you and you really didn't get 
a chance to lay out how this is going to happen. We all get it that 
the White House hasn't approved your proposal. We are hopeful 
that it will be approved. Surely, the other two witnesses were say- 
ing positive things about it, and we have been briefed, the mem- 
bers of this committee, by you on it, and we are positive. 

Could you put on the record how this is going to happen, what 
the governance structure will look like, and could you address the 
issue of whether you need legislation to accomplish this? 

Obviously, it makes no sense to have a brilliant proposal that no 
one follows, so I am sure you have already — I know you have al- 
ready thought about this, and I don't think we have testimony yet 
on the record about how this will get adopted across the federal 
government. 
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Mr. McNamara. Yes, Madam Chairman. First of all, how: Right 
now the committee that I am chairing is putting in what I hope 
is final form a series of recommendations that will be a report to 
the president. He has asked for that report. It is known as guide- 
line three, and we will be responding to that in, I expect, within 
a month or two, say, by the end of this quarter. 

We will send forward for review by the interagency process — that 
means deputies, principals and then sent to the president — a series 
of recommendations. It is not a study, it is not an investigation. 
What it is, is a series of policy recommendations for changing the 
current system and instituting a new regime called, CUI, as I men- 
tioned. 

Second, you asked about the 

Ms. HARMAN. The need for legislation. 

Mr. McNamara. For legislation. 

Ms. HARMAN. To make certain there is compliance. 

Mr. McNamara. Correct. There is in fact a group, a subgroup of 
this committee that has been looking at the legislative history of 
SBU and what might be necessary in the way of legislation for the 
implementation of a new regime. 

It is headed by the Department of Justice, and we expect, once 
we have given them the final version of this, that they will come 
back to us with recommendations, and we will include those rec- 
ommendations with the other recommendations. But those rec- 
ommendations can't be made until they look at the product that we 
are telling them that we want implemented. And then they will 
give us their opinion as to whether or not legislation is needed. 

On whether legislation is needed to get acceptance of this, the 
answer, I think, is, no. The president has asked for this, he wants 
it, and he will review it, I think, with dispatch. 

Ms. Harman. I thank you for your answers. My time has expired. 

I would just alert you and the public listening in that we are con- 
sidering legislation here on the issue of over-classification, which 
Dr. Morris spoke to briefly, as well as this issue. We think it is ab- 
solutely critical that we have understandable and clear rules for 
what information is protected and what information is shared. Oth- 
erwise, we think, we are not going to be able to get where we need 
to get, which is to block Al Qaida plots coming our way in real- 
time. 

I now recognize the ranking member of the subcommittee, the 
gentleman from Washington, for 5 minutes for questions. 
Mr. REICHBRT. Thank you, Madam Chair. 

Just to follow up on the chairwoman's last question, governance 
and legislation, I was taking notes during your testimony and 
didn't find it in your written testimony, but you mentioned 280 
pieces of legislation or ordinances and then another 150 — 

Mr. McNamara. Regulations. 

Mr. Reichert. — regulations. 

Is the group in DOJ, are part of their tasks to take a look at 
those 280 and 150 to see 

Mr. McNamara. Yes, indeed. In fact, they were the ones who 
came up with those numbers. 

Mr. Reichert. Oh, okay. 
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Mr. McNamara. They did a research project to find out what leg- 
islation created the current SBU system and what regulations were 
adopted subsequently after the legislation was passed to implement 
the requirements of the legislation. That is where that comes from, 
from that group. 

Mr. Reichert. Because I can see that maybe some of what we 
could do, Madam Chair, is pass a law eliminating some of these 
rules and regulations that might be inhibiting you in accomplishing 
that task. 

Mr. McNamara. Let me note that the vast majority, I believe, 
not having looked at all of them, but I have been told that the 
great majority of those simply require controls without going into 
detail as to what control mechanism should be put on specific kinds 
of information. The details of what controls were put on were deter- 
mined by the regulations. And, therefore, it is the opinion of this 
group at this point that many of those legislative mandates require 
just a change of the implementing regulations rather than go back 
and change the legislation. 

But the definitive answer will only come when we have a final 
set of recommendations that we can hand to the lawyers. 

Mr. Reichert. Great. Good. The subcommittee would be happy 
to be working with you on those changes. 

I wanted to ask Dr. Morris, you mentioned as a part of the DHS 
mandate that you have, in that statement that you read, it talks 
about appropriate state and local personnel, which includes the pri- 
vate sector. 

How do you define "appropriate"? Who does that include? 

Mr. Morris. That is an interesting question. As part of my talks, 
I have talked about that word exactly, because it was written in 
there. I think that is something we have to work with the state and 
locals. The program that we currently have is certainly focusing on 
the fusion centers that operate at the state level and at the local 
ones that have that. 

We believe that in the DHS program right now, that is where we 
are focusing our efforts and then working with the people in those 
fusion centers to understand where it needs to go beyond that. 

One of the things that I have actually talked to some people who 
worked for me for awhile is, how do we define, in working with the 
fusion centers, what are the other distribution methods that need 
to be there? Who else has to get the information in order to act? 

Mr. Reichert. Yes. 

Mr. Morris. I think that is the key thing. But right now our 
focus is through the fusion centers and working with the FBI and 
the activities that they do in the JTTF. 

Mr. Reichert. Good. Well, I think we all know from our experi- 
ence that there are a lot of people who think they are appropriate, 
and that is the tough part is letting some people that they are not. 

Also, we talked a few days ago, Ambassador, about cultural 
change as it relates to gaining trust and training, and it is also 
something that Mr. Murphy mentioned. 

I kind of know where you are at on that, Ambassador, but I was 
hoping maybe Mr. Murphy might comment since you mentioned it 
in here, in your opening statement. The cultural change, in your 
opinion, is the need to know versus the need to share. So I think 
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you nailed it when you said that. How would you say we are going 
to reach that goal? 

Mr. Murphy. I wish I could take credit for that. 

What really brought it home for me was when I was supporting 
a military operation as part of my responsibility at NSA, and after- 
wards we were doing a hot wash, and a Marine infantryman who 
was working as part of the front end operational activity told me, 
"What makes you think that you have my perspective? What 
makes you think you can make judgments about what I need to 
know and don't need to know? You need to understand my environ- 
ment better and work within my environment." 

That has resonated with me, particularly after 9/11, and the deci- 
sions I had made that made good sense at the time but, frankly, 
were parochial and limiting. I think this moves toward exposing 
our customers to the information that we have and letting them 
help us shape the message and shape the way it is delivered so the 
people that they represent is absolutely critical. 

And so changing the mindset, at the end of the day, is more im- 
portant than any process thing that we do, because if the mindsets 
change, the processes will really take care of themselves. 

Mr. Reichert. I appreciate that answer very much, and we are 
all three on the same page. 

Ms. Harman. The gentleman's time has expired. I appreciate 
that answer very much too. 

I now yield 5 minutes to the chairman of the full committee, Mr. 
Thompson of Mississippi. 

Mr. Thompson. Thank you very much, Madam Chairman. 

Good answer, Mr. Murphy. 

Dr. Morris, if we implement CUI framework, do you think we 
can get DHS to come along? 

Mr. Morris. Well, I don't think there is any problem with us 
coming along. I think that the only issue that I believe that we 
need to address in the end is going to be, how do we make sure 
with any new system we come up with that we build the trust in 
that system and the trust in the markings, the controls, the dis- 
seminations that are specified by that? 

One of the big challenges for us in DHS has been working with 
the private sector, particularly, in the sharing of threat information 
on our critical infrastructure. And what we are dedicated to do 
under the new system is to make sure that whatever it says on the 
top of the piece of paper along an electronic message that people 
trust that system. And we think that is so critical in working with 
the private sector. 

Mr. Thompson. And so do you think we can get our ICE, CBP, 
TSA to buy into it also? 

Mr. Morris. I didn't say it was going to be easy. Yes, I do. Actu- 
ally, I do. I think that we have socialized the proposal within the 
department. We haven't gotten back major pushbacks on it. I think 
people are still wondering how they are going to implement it, but 
in principle, yes, we have gotten acceptance. 

Mr. Thompson. Ambassador, what participation have we gotten 
in the development of this new framework from the private sector? 
Did you have any discussions with any private sector stakeholders 
or anything? 
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Mr. McNamara. Yes, we have. We have been in consultation 
with them. There is a committee that the Department of Homeland 
Security has formed with private sector partners to examine many 
issues related to homeland security, not just this issue of the SBU 
and CUI. And we have gone over with them in some detail various 
aspects of this proposed and this recommendation for CUI that 
would affect the private sector in particular. 

We have had telephone conferences, we have had meetings with 
them here in Washington. They are about, I think, within a few 
days or a week to send in some final comments on the CUI pro- 
posal as well as some other proposals that they have been looking 
at to, I think, the chair of that committee or that group, the assist- 
ant secretary for infrastructure protection at the Homeland Secu- 
rity Department, Bob Stephan. 

And my understanding, from phone conversations, et cetera, is 
that they will be favorably disposed. They believe that their needs 
will be met by this new proposal for CUI. 

Mr. Thompson. I yield back, Madam Chair. 

Ms. Harman. Thank you, Mr. Chairman. We have been so effi- 
cient that I would ask Sheriff Reichert if he has an additional ques- 
tion, maybe one, and then we will move to our second panel. 

Unless you do, Mr. Chairman. 

Mr. Thompson. I have no further questions. 

Mr. Reichert. I would like to just give Dr. Morris a chance to 
address the cultural change. I noticed you had your hand up and 
you might have a comment there. 

Thank you, Madam Chair. 

Mr. Morris. I was just going to make a comment. I was on an- 
other panel recently and we were talking about information shar- 
ing, and there was a representative from private industry who 
came to the panel and basically said that approaching information 
sharing the way we are doing it now is going to fail, because it 
doesn't address the issue of discovery. And that gets back to the 
key point that you were making is that we have to put in place a 
system that promotes discovery of information, find the people out 
there who need it. 

And then that is an area that we really need to start and con- 
tinue. It struck a note with me, and I certainly agreed with what 
I heard. 

Mr. Reichert. Madam Chair, if I could just quickly follow up. 
The public disclosure issue, as you mentioned discoveiy, is also one 
that I think the FBI might have to handle and deal with, isn't that 
true, all three, nod your head? 

Thank you. 

Ms. Harman. Well, I thank the witnesses and do agree with the 
ranking member that building trust is the key to making all of this 
work. Without that, discovery won't happen, changing cultures 
won't happen and getting information, accurate and actionable in- 
formation in real-time won't happen. 

This is, as far as I am concerned, the critical mission for this 
subcommittee to drive home. 

Ambassador McNamara, I hope when you leave this room you 
will call the White House and ask them what minute they are 
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going to approve your guidelines so we can get on with this. Right? 
Good. I know the phone number. 
[Laughter.] 

All right. This panel is excused. Thank you very much. 
Thank you very much, all. 

Are we now set up? Yes, we are. Counsel can take a seat next 
to me. 

I welcome our second panel. 

Our witness, Mark Zadra, serves as assistant commissioner, 
Florida Department of Law Enforcement, and is a 29-year veteran 
who has served in many leadership positions. Among them was 
overseeing the development and implementation of various intel- 
ligence and information technology systems. 

He served as special agent supervisor of the Domestic Security 
Task Force prior to his appointment to chief of office of statewide 
intelligence in 2002 and subsequently to special agent in charge of 
domestic security and intelligence. And as we heard, he welcomed 
600 people to Florida recently to have a conference on the critical 
subject of fusion centers. 

Without objection, Mr. Zadra's full statement will be inserted in 
the record. 

And I would now ask you to summarize in 5 minutes. 

STATEMENT OF MARK ZADRA, ASSISTANT COMMISSIONER, 
FLORIDA DEPARTMENT OF LAW ENFORCEMENT 

Mr. Zadra. Thank you, Madam Chair and distinguished mem- 
bers of the committee. I am pleased to speak to you today about 
the importance of common federal information sharing protocols 
and the impact that they have on the state, local and tribal govern- 
ments. 

Prior to 9/11, law enforcement agencies at all levels had little 
need to share sensitive information with non-law enforcement 
agencies. We had a generally accepted practice for sharing with one 
another, but because local and state law enforcement had minor in- 
volvement in the counterterrorism arena, we had limited experi- 
ence with classified information. Little consideration was also given 
to sharing information outside of law enforcement, and particularly 
with respect to the private sector, it was generally not done. 

The paradigm shifted after 9/11 when it became known that 14 
or more of the hijackers had lived, had traveled and trained in the 
state of Florida while planning their atrocities. One month later, 
Florida experienced the first of several nationwide deaths from an- 
thrax, which once again terrorized our nation. 

In light of these grim realities, we recognized that local, state 
and tribal resources, together with a whole new set of non-law en- 
forcement partners, including the private sector, represent the 
frontline of defense against terror and our best hope for prevention. 

Over the years, since 9/11, collectively, we have made great 
strides in overcoming the cultural barriers to information sharing. 
Despite many successes and a new cultural that encourages infor- 
mation sharing, barriers that impede the establishment of the de- 
sired national information sharing environment remain. 

Perhaps the single largest impediment is the lack of nationally 
accepted common definitions for document markings and standard 
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policy procedures for handling, storing and disseminating non-clas- 
sified information. 

Some states like Florida have open record laws, while other 
states impose very restrictive requirements and afford broad pro- 
tections from release. Florida's reputation is that of an open record 
state, and it is widely known. 

Exemptions provided by Florida's public record law are insuffi- 
cient to protect against public disclosure of all types of sensitive in- 
formation. The fear that sensitive information may not be protected 
under state law has a chilling effect on the free flow of information 
from out-of-state agencies and non-governmental to and from Flor- 
ida. 

We also believe that a lack of a standard definition results in fed- 
eral agencies over-classifying information in an effort to protect it. 

Developing and implementing a nationally accepted designation 
will provide Florida and other states with the justification that 
they need to encourage modification of state laws so that sensitive 
information can be protected. 

Florida supports the implementation of the controls, unclassified 
information framework to replace the existing, sensitive but unclas- 
sified designation. Implementation of the new standard will involve 
varying degrees of physical and legislative impacts. However, it is 
my opinion that acceptance will be facilitated if the guidelines are 
straightforward and delivered in clear and concise language that 
there is a single, nationally accepted, encrypted communication 
standard and system, which can also be used by non-law enforce- 
ment homeland security partners and that that be designated. 

The fiscal impacts are mitigated through the use of grants for 
the training and awareness programs and reprogramming of sys- 
tems to allow this new framework. 

And then implementation timelines need to consider the need to 
change policies and laws, purchase new equipment, do pro- 
grammatic changes and to do the training that I referenced. 

Federal agencies are now providing state and local agencies with 
significant amounts of threat information. Much of the information 
that is still needed, however, is classified at the national level in 
order to protect methods, means and collection and national secu- 
rity interests. Under most circumstances, however, we do not need 
to know the identity of the federal sources, nor the means, nor the 
methods of intelligence collection, only whether the information is 
deemed to be credible and specifically what actions that they want 
state, local and tribal authorities to take. 

Florida believes the implementation of state regional fusion cen- 
ters is the key to the establishment of the desired information 
sharing environment. These centers bring properly trained and 
equipped intelligence professionals with appropriate clearances to 
connect the puzzle pieces and disseminate actionable intelligence. 

The problem remains that, unfortunately, most of the operational 
components at the state and local level that may benefit from the 
information and would otherwise be available to report on indica- 
tors and warnings we observed in the field will never have access 
to this information because of the classifi cation. 

Tear line reports forwarded to fusion centers can help address 
this particular concern. So state, local and tribal law enforcement, 
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in addition to other discipline partners and the private sector, can 
receive information that they can act upon. 

Madam Chair and members of the subcommittee, thank you for 
the opportunity to appear and testify before you. I can assure you 
that the state of Florida is encouraged by your interest in facili- 
tating an enhanced information sharing environment across the na- 
tion. It is my hope that the testimony and the understanding of 
Florida's desire to be a strong participant in the flow of critical, 
sensitive information and intelligence nationally will be help on 
your endeavor. 

And, ma'am, if I may take 15 more seconds. I want to, from a 
state perspective and probably on behalf of Colonel Johnson, to 
thank you for the recognition and the gratefulness on behalf of the 
nation for the agency's loss of their trooper, the New York state 
trooper, the New York state police and lost his family and agency. 
And thank you for recognizing the sacrifice of the state and local 
and tribal multidisciplinary partners that are also part of this fight 
on terror. 

Thank you. 

[The statement of Mr. Zadra follows:] 

Prepared Statement of Assistant Commissioner Mark Zadra 

Good morning Madam Chair and distinguished members of the Subcommittee. 

My name is Mark Zadra and I am a 29 year member of the Florida Department 
of Law Enforcement (FDLE). FDLE is a statewide law enforcement agency that of- 
fers a wide range of investigative, technical and informational services to criminal 
justice agencies through its seven Regional Operations Centers, fifteen Field Offices, 
and six full service Crime Laboratories. Our primary mission is to promote public 
safety and strengthen domestic security by providing services in partnership with 
local, state and federal criminal justice agencies to prevent, investigate, and solve 
crimes while protecting Florida's citizens and visitors, FDLE utilizes an investiga- 
tive strategy that comprises five primary focus areas including Violent Crime, Major 
Drugs, Economic Crimes, Public Integrity and Domestic Security. 

I was recently appointed as FDLE's Assistant Commissioner of Public Safety 
Services however, prior to that appointment I served as the Special Agent in Charge 
of Domestic Security and Intelligence and the state's Homeland Security Advisor. 
In those roles I have overseen the development and implementation of various intel- 
ligence and information sharing programs and systems for FDLE and subsequently 
for the State of Florida. I have also overseen the development and implementation 
of the prevention component of Florida's Domestic Security Strategy and Florida's 
implementation of national information-sharing initiatives such as the Homeland 
Security Information Network (HSIN) and Florida's fusion center. I have further 
been an active participant on the Global Justice Information Sharing Initiative — 
Global Intelligence Working Group (GIWG). The goals of the GIWG include seam- 
less sharing of intelligence information between systems, allowing for access to in- 
formation throughout the law enforcement and public safety communities, creating 
an intelligence sharing plan, determining standards for intelligence sharing, devel- 
oping model policies, determining training needs, and creating an outreach effort to 
inform law enforcement of the result of this effort Over the last ten months I have 
been afforded an opportunity to provide input to the GIWG regarding the develop- 
ment of the recommended common protocols for sharing and protecting sensitive in- 
formation and intelligence among multiple agencies with a role and responsibility 
in homeland security. 

I am pleased to speak to the Committee today about the importance of common 
federal information sharing protocols and the impact they have on state, local and 
tribal governments. 

Prior to 9/11, law enforcement agencies at all levels had little need to share sen- 
sitive information with non law enforcement agencies. We had generally accepted 
practices for sharing information with one another but, because local and state law 
enforcement had minor involvement in the counterterrorism arena, we had limited 
experience with federally classified information. Little consideration was given to 



VerDateNov24 2008 15:42 Jun 07, 2009 Jkt 000000 PO 00000 Frm 00072 Fmt6601 Sfmt6621 H:\DOCS\110HRGS\110 20\35279.TXT MSEC PsN: DIANE 



69 



sharing sensitive information outside the law enforcement community, and sharing 
information with the private sector was generally not done. 

The paradigm shifted after 9/11 when it became known that fourteen or more of 
the hijackers had lived, worked, traveled and trained across Florida while planning 
the atrocities they would ultimately commit. In their daily activities they left, many 
clues that, if viewed together, may have predicted the plan and given authorities 
an opportunity to avert the catastrophic consequences. One month after the horror 
of 9/11, Florida experienced the first of several nationwide deaths from Anthrax 
which once again terrorized our nation. In light of these grim realities, we recog- 
nized that local, state and tribal resources together with a whole new set of non- 
law enforcement partners including the private sector- represent the front line de- 
fense against terror and our best hope for terror prevention. Appropriately shared 
information is the key weapon in moving from the role of first responder to that 
of first preventer. 

Sharing information with agencies such as health, fire, emergency managers, and 
even non governmental entities with a role in the fight against terror presented new 
challenges, not just the inherent cultural ones, but those relating to law, policy/pro- 
cedure, technology and logistics. Over the years since 9/11, collectively, we have 
made great strides in overcoming the cultural barriers to sharing information. In 
Florida, through our Domestic Security Strategy and governance structure, we rou- 
tinely work with and share information across all entities that have a role in pro- 
tecting the safety and security of our citizens. 

Despite these successes and a new culture that encourages information sharing, 
barriers that impede the establishment of the desired national Information Sharing 
Environment (ISE) remain. 

Common Document Markings and Dissemination Protocols 

Perhaps the single largest impediment to an effective national ISE is the lack of 
nationally accepted common definitions for document markings and standard policy/ 
procedure for handling, storing, and disseminating non classified information. Sen- 
sitive but unclassified information, which is routinely received from federal and 
other state agencies, is needed by state, local, tribal and private sector partners that 
have a duty and responsibility to utilize it to provide for our safety and security. 
Consistency in definition and protocol is paramount to both fully sharing useful and 
actionable inf ormation, and protecting information that should not be shared. 

Some states, like Florida have open record laws that mandate revealing informa- 
tion compiled by governmental agencies unless a specific "chapter and verse" exemp- 
tion or confidentiality provision applies. Other states impose very restrictive dis- 
semination requirements and afford broad protections from release to those without 
a need to know. Florida's reputation as an open records state is widely known. 
While Florida law exempts certain information from public disclosure, the most like- 
ly exemptions applicable to the type of information that I am discussing are limited 
to criminal intelligence/investigative information and information that pertains to a 



by Florida's Public Records Law are insufficient to protect against public disclosure 
of all types of sensitive information needed by Florida's domestic security partners. 
For example, there is no specific exemption in Florida's public records law for infor- 
mation provided to Florida by a non Florida agency unless it is intelligence or inves 
tigative information both of which have fairly narrow definitions under Florida 
law. The fear that sensitive information may not be protected under state law has 
a "chilling effect" on the free flow of important information from out of state agen- 
cies and non governmental entities to and from Florida. We also believe that the 
lack of a standard designation results in federal agencies over classifying their infor- 
mation in an effort to protect it. Information and intelligence sharing partners need 
to know, with certainty, that the information they share will be appropriately pro- 
tected. At the same time, we understand there must be appropriate limits on what 
is removed from public scrutiny and review, and a balance achieved between prop- 
erly informing the public and ensuring the safety and security of our state and na- 
tion. 

Developing and implementing a nationally accepted designation, with clear and 
appropriate handling and dissemination standards for sensitive information, will 
provide Florida and other states with the justification they need to encourage modi- 
fication of state laws so that sensitive information can be protected in compliance 
with an accepted national standard. 

Fortunately, there appears to be a workable solution to the concerns I have identi- 
fied. Florida supports the implementation of the Controlled Unclassified Information 
(CUI) framework to i"eplace the existing Sensitive But Unclassifed (SBU) designa- 
tion. The SBU designation contains numerous confusing designations used to mark 



facility's physical 
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unclassified information. The recommended CUI framework streamlines existing 
designations and provides handling requirements that facilitate wide distribution 
among law enforcement, homeland security, other government sectors and the pri- 
vate sector. We strongly believe that the information sharing environment man- 
dated by Presidential Guideline 3 cannot be fully achieved without the implementa- 
tion of a model such as the CUI framework. In the absence of common protocols, 
existing classification schemes will continue to be over utilized and/or improperly 
utilized, resulting in the inability of persons who receive information to adequately 
distribute it to those with a duty and responsibility to take action to protect our 
citizens. 

We believe that the recommendations made by the Sensitive But Unclassified 
Working Group reflect workable solutions that could be accepted and replicated by 
most states. As a state representative I have been afforded an opportunity to review 
and comment on these recommendations during their formulation. I have also had 
the pleasure of personally meeting with Ambassador Thomas E. McNamara, Office 
of the Program Manager for the Information Sharing Environment and espousing 
Florida's views with respect to this and other information sharing topics. 

Implementing CUI 

In the absence of federal guidance and standards, many states, including Florida, 
have already expended resources in building systems and programs to fill the infor- 
mation needs of their consumers. Implementation of the new standard will involve 
varying degrees of fiscal and legislative impacts, however it is my opinion that ac- 
ceptance will be facilitated if: 

1. Guidelines are straight forward and delivered in a clear, concise language; 

2. A single, nationally accepted, encrypted communications system and federal 
information sharing encryption standard that can be used by non law enforce- 
ment homeland security partners is designated; 

3. Fiscal impacts are mitigated through grants f or training and awareness pro- 
grams, as well as for new equipment and system re programming; and 

4. Implementation timeline considers the potential need for state, local, and 
tribal governments to: 

a. Change policy and/or rules to comply with new information dissemination 
requirements; 

b. Purchase new equipment and/or system programming changes; and 

c. Train appropriate personnel in markings, handling, storage and dissemi- 
nation requirements. 

For Official Use Only Tear Line Reporting 

In response to post 9/11 criticism regarding failure to share information vertically 
and horizontally across the spectmm of homeland security partners, federal agen- 
cies arc now providing state and local agencies with significant amounts of threat 
information. Much of the information that is still needed, however, is classified at. 
the national level in order to protect sources, methods and means of collection and 
national security interests. State and local law enforcement fully understand and 
appreciate the need to protect certain information and restrict dissemination to only 
those with a need or right to know. Under most circumstances, however, we do not 
need to know the identity of federal sources or means and methods of intelligence 
collection — only whether or not the information has been deemed credible and spe- 
cifically what actions that the state, local and tribal entities should take. 

Florida believes the implementation of state and regional fusion centers is key to 
the establishment of the desired Information Sharing Environment. These centers 
bring properly trained and equipped intelligence professionals with appropriate 
clearances to connect the pieces of the puzzle ana disseminate actionable intel- 
ligence. The problem remains that once the classified material is fused with the 
non classified information from which analysis is performed, the information takes 
on the restrictions with the classified information which significantly narrows to 
whom and how it can be shared. Unfortunately, most of the operational components 
at the state and local level that may be benefit from the information, and would 
be otherwise available to report on the indicators and warnings being observed with- 
in the field, will not ever have access to this information. Tear line reports for- 
warded to fusion centers can help address this particular concern so that state, local 
and tribal law enforcement in additional to other discipline partners and the private 
sector receive inf ormation thai, they can act upon. 

In conclusion, I would like to compliment our federal partners for recognizing the 
value of state, local and tribal representative's expertise and allowing input on such 
a critical initiative prior to its implementation. This has not always been the case, 
but is a testament to the positive change in the information sharing culture and es- 
tablished and improved partnerships. I have been honored to be a member of the 
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Global Intelligence Working Group and would like to acknowledge the work done 
by those professionals under the guidance of their Chairman, New York State Police 
Deputy Superintendent, Bait Johnson. 

Lastly, Madam Chair and Members of the Sub Committee, thank you f or the op- 
portunity to have appeared and testified before you today. I can assure you the 
State of Florida is encouraged by your interest in facilitating an enhanced inf orma- 
tion sharing environment across the nation. It is my hope that this testimony and 
the understanding of Florida's desire to be a strong participant in the flow of critical 
sensitive information and intelligence nationally will be helpful in your endeavor. 

Ms. Harman. I thank the witness for your testimony and now 
yield myself 5 minutes for questions. 

Let me say, first, Mr. Zadra, that I think we need to bottle you. 
I am not sure what that process could involve, but I would like to 
a bottle of you to sit on Charlie Allen's desk and I would like a bot- 
tle of you to sit on the desk of the appropriate people at the CIA 
who have a great role to play in our present classification system. 

And I definitely want a big bottle of you to be sitting on Fran 
Townsend's desk in the White House, as we move forward. Because 
it is absolutely critical, as you said, that you have timely informa- 
tion. And we have both classification and pseudo-classification sys- 
tems that are making that more difficult than it should be. 

No one is arguing about the need to protect sensitive sources and 
methods. I served for 8 years in the House Intelligence Committee, 
and I think I get it, but I haven't found a defender, and I would 
disagree with such a person if I found one, who says that our 
present system works well. It doesn't, it is broken, and this is hear- 
ing is about how to fix at least a portion of it, and this sub- 
committee will focus on trying to fix as much of it as we can get 
our arms around. 

I want to ask you about a specific situation. I don't think anyone 
in the country and most people around the world missed the tragic 
events at Virginia Tech last week where 32 students and faculty 
lost their lives. Initially, it was not known who the shooter was. It 
turned out to be, we think, a mentally ill student acting alone. 

But I want to ask you, from your perspective, what were you 
thinking about when that information came over the wire? For ex- 
ample, were you thinking, is this a terrorist plot, is this the first 
phase, is this going to roll out in some of my universities in Flor- 
ida? 

And what information were you able to get in real-time as you 
had those thoughts, and from whom? 

Mr. Zadra. Madam Chair, I can assure you that the state of 
Florida, there is not an incident that happens within our state, 
whether it is an accident of hazardous materials on a roadway or 
anything across the country, our mindset initially is first to deter- 
mine whether or not it has a potential nexus to terrorism. I think 
we all learned a lesson after 9/11. 

Certainly, when this happened our immediate thought, the Flor- 
ida Department of Law Enforcement has protective operations de- 
tail for our governor and also for our legislature and cabinet. And 
we, of course, when we first heard the news, were concerned, did 
we have a nexus to anything within our state and our particular 
universities and colleges that we needed to also be concerned with. 

Fortunately, because of the fusion center concept now, we have 
an embedded Department of Homeland Security analyst within our 
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state fusion center. Very immediately two things happened. We 
reached out immediately, through our DH analyst, to the national 
operations center, and we were advised very quickly that there was 
no known nexus to terrorism. Of course, it was still unfolding at 
that time, but there were no initial indicators. 

The second thing that happened, which I think is proof positive 
about the fusion center concept is that the Virginia fusion center 
began putting out information that was made available to the other 
state fusion centers. And that was extremely critical and beneficial 
to us. 

I know the last thing that we would want to do as a state is to 
call and begin impacting the local law enforcement agencies that 
were responding to that tragic incident. They had their hands full. 
To have a state, a thousand or more miles away, calling and want- 
ing to check to know the status of everything, it would be under- 
standable that that could be an impediment to them. 

But because of the fusion center there and to be able to reach 
out to them directly and with them providing updates to us, and 
I know the last I saw was update number six, I know at least six 
updates were provided from that fusion center to all fusion centers 
across the nation. 

Ms. HARM AN. Well, that is a good news report. That is not a re- 
port you could have given a year or two ago, am I right? 

Mr. Zadra. Yes, ma'am, that is correct. 

Ms. HARMAN. Fusion centers, which have been the subject of 
other hearings, are beginning to work. DHS does have personnel 
embedded in 12 of them. You are obviously one of 12. We are trying 
to help move more DHS people there, and I am just assuming that 
the products you saw also reflected, for example, FBI input, since 
they are typically a part of the fusion center. Is that correct? 

Mr. ZADRA. Yes, ma'am, that was my understanding, that there 
was a cooperative effort. And let me add, too, that we are awaiting 
our FBI analyst. We will have an FBI analyst also embedded in our 
state fusion center. The member has just not arrived yet, but we 
are expecting that soon. 

Ms, HARMAN. Well, I hope that does happen. I mean, the goal, 
again, is to get the right people and right information to the right 
places in real-time. Do you agree? 

Mr. Zadra. Absolutely. 

Ms. HARMAN. I thank you very much, Mr. Zadra, and now yield 
5 minutes to the ranking member for questions. 
Mr. REICHERT. Good morning. 
Thank you, Madam Chair. 

First of all, you mentioned open record laws. I am from Wash- 
ington state, was the sheriff there for a while. In 33 years of law 
enforcement, one of the frustrating things in working with the fed- 
eral government, and you touched on, was sharing that information 
and as they shared it with the local sheriffs office in Seattle, it be- 
came subject to the public disclosure laws of the state of Wash- 
ington. 

Can you talk a little bit about that, how that discussion occurred 
within the framework of your involvement in discussing where one 
had the future of sharing information? 
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Mr. Zadra. Yes, sir. In the state of Florida, we have some exemp- 
tions from public disclosure, and from our perspective there are 
usually three that we point to. One is active criminal investigation, 
the other is active criminal intelligence, and then the other deals 
with security plans, which include photographs, floor plans and 
things like that, of critical infrastructure. 

While those are good, there is a hole, so to speak, with sensitive 
information, because now, after 9/11, we have a lot of different 
partners that we need to share with — health, fire, emergency man- 
agers. So a lot of the information that we get is not active criminal 
investigation, it is not active criminal intelligence, and it is not a 
floor plan, it is not a photograph. 

For example, if we have mass prophylaxis from dealing with 
health issues and where that is stored and how it is transported, 
as we have hazardous materials come through our state, we want 
to alert our Florida highway patrol, we want to alert our motor car- 
rier compliance, our Department of Agriculture, their weigh and in- 
spection stations, of the flow of this. 

Under our current public records exemptions, that information is 
not criminal investigative, it is not criminal intelligence, and it is 
not a security plan. We attempt to protect it under those type 
things, and we have been pretty much successful. 

But to have a national framework that we — and I have talked to 
both our house and our senate in our state, and if we had a na- 
tional framework that we could point to, to say, this is a nationally 
accepted, controlled, unclassified information that we could amend 
our state laws to provide those protections so that when we need 
to share with other states, they have confidence that the state of 
Florida, despite being an open records law state, that we can pro- 
tect the information they share with us. 

Mr. REICHERT. Very good. The last part of my question was going 
to address the last part of your answer. 

I was also wondering what your opinion might be in this whole 
area of governance, because local law enforcement has difficulty at 
the state level, the sheriffs level and the police chief. Who is going 
to be in control of the information? The governance issue is a big 
one, as you know. It is always a huge issue. 

How did that discussion play out in your discussion of SBU and 
all the players around the table? That governance issue is always 
touchy. 

Mr. Zadra. The state of Florida is a participant in the Global In- 
telligence Working Group under the global justice initiative, and so 
the state of Florida has been able to provide input. I personally 
have been able to review the recommendations and provide input 
to those. 

I also served, as homeland security advisor until most recently, 
and we have seven regional domestic security task forces that all 
have intelligence operations and components. So we have had dis- 
cussions with those, and everyone agrees that this is a difficult, 
and we need a national standard. 

We have awaited, of course, understanding the formal adoption 
of these before we have done a lot of pushing out to our state, be- 
cause one thing that happens, while you want to have the input 
from your local state, one thing that has happened to us that en- 
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couraged our federal partners, it really needs to be done and it 
needs to be done right, so when we take it and share it, we can 
share it once, and it doesn't move, and it doesn't change. 

One of the most detrimental things that has happened to us in 
the past is the rollout of new programs, and I have heard them de- 
scribed as, well, we were building this airplane on the fly. 

To be honest with you, sir, I don't want to fly on an airplane that 
is being built while I am on it, as we are flying. 

And so what happens is you push these things out to the states, 
the locals. The federal government begins to lose credibility be- 
cause it continues to change and morph. 

So, truthfully, from the state's perspective, what we have done 
is we would like to know that there are recommendations, we have 
provided input, and once we believe that they are close to being fi- 
nalized, to be able then to really push that through our state 
framework. 

Mr. REICHERT. Great. Thank you so much. 

I yield. Thank you, Madam Chair. 

Ms. HARMAN. Thank you, Mr. Reichert. 

We have votes coming up shortly, but I do have another question 
or two, and so I hope you will join me in a second round of ques- 
tions until we can adjourn the hearing for voting. 

First of all, it is Mr. "Zadra"? Is that correct? 

Mr. ZADRA. Yes, ma'am, but anything is fine. 

[Laughter.] 

Ms. HARMAN. Well, you are very flexible, but this is my second 
goof of the morning here, besides recognizing another witness out 
of order. I apologize to you, and we will now produce Zadra pills, 
which we are going to put in every federal office. 

I surely agree with you, in answer to your last question, that it 
needs to be done right. But it also needs to be done now. Do you 
agree with that? 

Mr. Zadra. Yes, ma'am. 

Ms. HARMAN. Okay. 

Mr. Zadra. If not, the state and locals, like we have done on 
many things in the past, we have implemented our own methodolo- 
gies and that continues to lead to the confusion and interoper- 
ability between states. So you are correct. It needs to be right, and 
it needs to be done as soon as possible. 

Ms. HARMAN. So we have the ambassador calling the White 
House today, and we will have approval later today. That would be 
nice, obviously. Then we need a forcing mechanism across the fed- 
eral government. 

My question to you is, would some funds for training help push 
this concept into the states? I know there are some other issues 
that you were just discussing with Mr. Reichert, but would training 
money be of use to you? 

Mr. ZADRA. Madam Chair, absolutely, and the recommendation 
for Florida that we have made, particularly through the Depart- 
ment of Homeland Security, deals with the federal grant funding 
programs, and I know that you are highly aware of those different 
ones. 

We would ask, because currently we fund our fusion center ef- 
forts through the Law Enforcement Terrorism Prevention Program, 
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we would ask, because the fusion centers are so critical to this en- 
tire effort, that there be thoughts, just as there are designated port 
grants or transit grants, that we designate fusion center grants. 
And I believe that the money in a fusion center grant is so tied to 
what we are talking about that we would use those funds in con- 
junction with the fusion centers to deal with how we would train 
how to use CUI. 

Ms. HARMAN, Well, we are working right now on several pro- 
posals to push more money into fusion centers to help with local 
training, local involvement, also to get DHS people in every fusion 
center. I was confused about your answer before, probably my 
fault, about the Virginia Tech information. Your fusion center does 
or does not presently have a DHS person in it? 

Mr. Zadra. It does. 

Ms. HARMAN. It does. 

Mr. Zadra. It has since January. 

Ms. HARMAN. And that fusion center was what you contacted, 
and it got in touch with the Virginia fusion center; is that what 
happened? 

Mr. Zadra. Our state Florida fusion center made contact with 
the Virginia fusion center. Our Department of Homeland Security 
analyst made direct contact to the national operations center, 
which is the Department of Homeland Security. We went both 
ways. 

Ms. HARMAN. So we had a real live example of information shar- 
ing, horizontally at the local level and vertically with the federal 
intelligence community; is that correct? 

Mr. Zadra. Yes, ma'am. That is not the first time. I think we 
continually see progress and movement. And, again, the creation of 
state and the regional fusion centers and then having our federal 
components embedded in those, I think, are the best things that we 
could be doing. 

Ms. HARMAN. Well, we totally agree. We think that is one of the 
best things. We think another of the best things is to change the 
way we protect information so that we only protect what we need 
to protect and we share the rest of it, both on the classified side 
and the pseudo-classified or non-classified side. And that is why we 
are having this hearing. And I think you are on the same page; am 
I right? 

Mr. Zadra. Absolutely. I couldn't agree more. 

Ms. HARMAN. I thank you again for your very valuable testi- 
mony, Mr. Zadra, and now yield for additional questions to the 
ranking member. 

Mr. REICHERT. I just have two or three follow-ups. Thank you, 
Madam Chair. 

How much of your budget is dedicated to homeland security ef- 
forts? Would you know the answer to that? 
Mr, Zadra. How much of our state budget or federal grant? 
Mr. Reichert. Your agency's budget. 

Mr. Zadra. Our agency budget? Not a tremendous amount, and 
the reason why is because our state legislature, and I can forward 
it to you later, if you would like, sir, our state statute that des- 
ignates our domestic security efforts in Florida indicate that we are 
to maximize federal funding. 
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I believe that Florida has placed approximately $25 million of 
state revenue into this. Florida, fortunately, because of the critical 
infrastructure landscape that we have, we have been treated very 
well from the national level. I mean, we would always want more, 
but Florida has been a recipient and last year was the third largest 
amount of federal funding from the Department of Homeland Secu- 
rity. 

Mr. REICHERT. What is your agency's training budget? What per- 
centage of your budget goes to training? 

Mr. ZADRA. Sir, I don't know the answer to that. I don't have 
that with me today. I can certainly provide that as a follow-up to 
you. I do note that we also maximize our federal homeland security 
funds to deal with our training. 

Mr. REICHERT. And to further follow up on the chair's question 
regarding funding, would it be helpful to you to have additional 
funds that would pay for backfill as you send people to training? 

Mr. ZADRA. Yes, sir. To be honest with you, I am sure it would 
be greatly appreciated. I think I can say on behalf of the state of 
Florida, particularly from the law enforcement component, is that 
this is our mission. It is clear to us. This is just as important as 
responding to any burglary, rape, robbery, and we would do it if 
you didn't give us backfill. 

I will say this from the fire side: The fire, we do provide backfill 
and overtime for them. Because when you take a hazardous mate- 
rial truck and you send them all to training, that is loss. So if you 
take one member and they don't have enough to have that team, 
so they have to backfill that. Law enforcement, we are a little bit 
different. 

So I guess the best way to answer that, we would be happy to 
receive it and it would be a benefit, but I will assure you the state 
of Florida is going to do what is necessary, even if we did not have 
it. 

Mr. REICHERT. Well, one of the things we talked about — this is 
the last question I have — is creating an environment of trust. And 
I just have to smile, still being probably new here in my second 
term, beginning my third year at the federal acronyms, so just 
today SBU, CUI, ISE, PCI, ICC. So when you talk about building 
trust and user friendly, the local cops really would like language 
they can understand, don't you agree? 

Mr. ZADRA. Sir, interesting that you bring that up, as Governor 
Crist, our newly elected governor, his very first executive order was 
a plain language initiative in the state of Florida. 

Mr. REICHERT. Yes. I think it is a great idea. 

Mr. ZADRA. We concur wholeheartedly. It needs to be very plain, 
it needs to be simple. And no disrespect to our law enforcement of- 
ficers who are obviously very confident, but it makes sense that 
whatever we do has to be simple so that we can assure it is done 
properly and that it will be utilized. If it is too complicated, it is 
not going to be utilized and we won't effect what we are after. 

Mr. REICHERT. Well, certainly appreciate your time, and thank 
you for your service to your community. 

And I yield back. 

Ms. Harman. I thank the gentleman for yielding back. 
The time for questions has expired. 
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I would just note to Mr. Zadra that I often say the dirtiest four- 
letter word in government is not an acronym; it is spelled T-U-R- 
F, and it has a lot to do with the subject we are discussing today. 

The hearing is adjourned. 

[Whereupon, at 11:22 a.m., the subcommittee was adjourned.] 
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MAKING DHS THE GOLD STANDARD FOR 
DESIGNATING CLASSIFIED AND SENSITIVE 
HOMELAND SECURITY INFORMATION 

PART III 



Thursday, June 28, 2007 

U.S. House of Representatives, 

Committee on Homeland Security, 
Subcommittee on Intelligence, Information Sharing, 

and Terrorism Risk Assessment, 

Washington, DC, 

The subcommittee met, pursuant to call, at 10:08 a.m., in Room 
311, Cannon House Office Building, Hon. Jane Harman [chair- 
woman of the subcommittee] presiding. 

Present: Representatives Harman, Langevin, Carney, Reichert 
and Dent. 

Ms. HARMAN. The hearing will come to order. 

I apologize to my colleagues and our witnesses for needing to be 
in two places at the same time, but the Energy and Commerce 
Committee is marking up the energy bill, and that includes things 
like plug-in hybrids, which are a huge issue for California. So I 
will, as soon as my BlackBerry goes off, have to go out; and Mr. 
Langevin will chair the hearing for a period. 

But I would like to welcome our witnesses and welcome our 
panel and take a deep breath and launch. Good morning. 

According to last Sunday's Washington Post, the Vice President 
is inventing his own classified and unclassified designations to 
keep his work products secret. My personal favorite — and I have 
never heard of this designation in my 8 years on the House Intel- 
ligence Committee — is, quote, treated as Top Secret SCI, unquote. 

According to the Post, experts in and out of Government said 
Cheney's office appears to have invented that designation, which 
alludes to Sensitive Compartmented Information, the most closely 
guarded category of Government secrets. By adding the words 
"treated as", the Post noted, the Vice President seems to be seeking 
to protect his unclassified work as though its disclosure would 
cause exceptionally grave damage to national security. 

The problem is that the Vice President and some other law en- 
forcement and security agencies believe that they should decide 
which information they can keep secret, regardless of the law, rules 
or what the needs are of our local law enforcement community. 

In my view, this is bad policy. But, not only that, it poses huge 
obstacles to our need to connect the dots in time to protect, to pre- 
vent or to disrupt the next terrorist attack against us. 

(79) 
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I ask the question, what hope is there for the controlled unclassi- 
fied information regime being developed by the program manager 
of the Information Sharing Environment at the DNFs office if we 
have agencies and parts of our White House that are going to con- 
tinue to make their own decisions on what information they keep 
secret? 

One of our witnesses today is a player, a participant, in the con- 
troversy involving the Vice President's office. Bill Leonard of the 
Information Security Oversight Office testified before this sub- 



hearing, he and other witnesses helped paint a picture of the con- 
sequences of abusing the classification regime and its outrageous 
costs to both taxpayers and our information-sharing efforts. 

I am aware, Mr. Leonard, that the Justice Department is cur- 
rently trying to resolve the issue between your office and the Vice 
President, and I anticipate that you may not be able to comment 
on the issue, but surely I personally admire your courage, and I 
think you are on the right side. 

Mr. Leonard appears today to testify about what he believes the 
Department of Homeland Security should do to reduce the prob- 
lems from overclassification and pseudo-classification. 

And our other witnesses, each of our other witnesses, brings 
enormous expertise to this. Several of you have been witnesses be- 
fore us before. All of you are people whom I talk to on a regular 



Let me just state a few other tentative conclusions that we have 
reached after exploring this issue for some time. 

Number one, the only way to insure that relevant homeland se- 
curity information is shared between the Federal Government and 
its State, local, tribal and private sector partners is to create a clas- 
sification and pseudo-classification system that is enforceable, un- 
derstandable and applicable to everyone. 

Number two, almost 6 years after 9/11, we should be treating far 
less information as classified. 
Number three, fixing this should be a top priority. 
Number four, classified markings are not— repeat not — to be 
used to protect political turf or hide embarrassing facts from public 
view. They should only be used to properly hide — if that is a good 
word — or protect sources and methods from public view because if 
those sources and methods are disclosed, people die and informa- 
tion dries up. 

Indeed, a recurrent theme throughout the 9/11 Commission's re- 
port was the need to address the problems of over — and pseudo — 
classification to clear up a major stumbling block to dealing with 
terrorist threats. 

While I hope that Congress will fashion a Government-wide solu- 
tion, this committee, the Homeland Security Department and this 
subcommittee is a good place to start. We can try to figure out 
what Homeland Security should be doing, and we can hope that 
what we propose for the Homeland Security Department can be- 
come the best practices Government- wide. 

As I mentioned, we have phenomenally good witnesses before us 
today; and I look forward to working with them, continuing to work 





right. 
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with them, and to working on a bipartisan basis with Sheriff 
Reichert getting this right. 

I would like to extend a warm welcome to everyone and would 
now yield to the ranking member for his opening comments. 

Mr. Reichert. Thank you, Madam Chair; and welcome to all of 
you. 

I have a couple of pages of prepared comments, but I am just 
going to read one paragraph, and then I am going to comment from 
more of a local perspective. 

This subcommittee is to focus on the Department of Homeland 
Security and actions that they can do better in terms of overclassi- 
fication, pseudo-classification. However, in crafting legislation, we 
must not lose sight of the fact that overclassiflcation is a Govern- 
ment-wide problem, and that requires Government-wide solutions. 
I think really that kind of boils the whole thing down. 

I just want to again comment from a local perspective. It has 
only been a little over 2 years since I came from the Sheriffs Office 
in Seattle. I had 33 years experience there, some working with the 
Federal officials, the FBI, Secret Service and DEA and ATF and 
you name it, from a detective's perspective in sharing information 
and working as partners in investigating crimes. 

One of those crimes, as I mentioned in earlier hearings, is a well- 
known case called the Green River Murder Investigations, where 
we had nearly 50 to 60 Federal agents assigned to the task force. 
I operated there as the lead investigator from the middle 1980s 
into the early 1990s. We had difficulty obtaining information from 
the Federal agencies and agents that worked there with us, right 
alongside, side by side. 

My partner, FBI agent Special Agent Bob Agnew, shared infor- 
mation with me because we built a relationship. We had a friend- 
ship where we trusted each other. But the agency itself classified 
the documents that were associated with our case at a level where 
I had no access to the documents in our own case. So this is back 
in the 1980s. 

So when we finally come to make an arrest years later, 19 years 
later, while I then served as the first elected sheriff in 30 years in 
Seattle, I had the opportunity once again to oversee for 2 years the 
investigation of this serial murder case that solved 50 murders. 
Part of that investigation then required that we go back to the Fed- 
eral agency, the FBI, and acquire the documents that they had pro- 
duced during that investigation for discovery so that we could pur- 
sue charges against the suspect. They refused to give them to us. 
That is ridiculous, and it touches on the level that the Chair men- 
tioned at a local level. 

Really, it boils down to, look, cops on the street, the local cops, 
the local sheriffs deputies, the State Patrol, you know, the State 
agencies, and all the other Federal agencies, the guys and gals on 
the street do not care one iota about the Vice President and the 
politics of this stuff. What they want is a system in place where 
we can share information, where we can build that trust, that sort 
of friendship that Bob Agnew and Dave Reichert had back in the 
mid-1980s, where we could share the information vital to inves- 
tigating a local crime. 
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Now, in today's world, after September 11th, vital to the security 
of this Nation, because, as we have all said over and over again in 
this subcommittee and in our full committee, the involvement of 
local law enforcement is critical in the protection of our country. 
And if we don't share information with our local agencies and we 
can't trust each other and build trust between local agencies and 
Federal agencies, this country's safety is at great risk. 

So I know all of you are working hard to overcome this problem, 
but I wanted to share with you just one of my experiences in my 
33-year career working with one Federal agency. I have other sto- 
ries I could share with you that would illustrate this point, but I 
won't take the time this morning. 

So I appreciate you being here this morning and look forward to 
your testimony. 

Madam Chair, I yield. 

Ms. HARMAN. I thank the gentleman for his comments and would 
note that other members of the subcommittee are reminded that, 
under committee rules, opening statements may be submitted for 
the record. 

Ms. HARMAN. As mentioned, I welcome our four witnesses. 

Our first witness, Mr. William Leonard, is the Director of the In- 
formation Security Oversight Office. The ISOO reports to the Presi- 
dent and is responsible for policy and oversight of the Federal Gov- 
ernment-wide security classification system and the National In- 
dustrial Security Program. 

Mr. Leonard has testified several times before Congress about 
the need to break down the classification impediments to informa- 
tion sharing. Some of them were just graphically mentioned by Mr. 
Reichert. 

Our second witness, and a very long-standing friend of mine, is 
Scott Armstrong, who is the Executive Director of the Information 
Trust, a nonprofit group that works toward opening access to Gov- 
ernment information. He has been inducted into the Freedom of In- 
formation Act, FOIA, Hall of Fame — that is impressive; I hope you 
are wearing the medal — and was awarded the James Madison 
Award by the American Library Association. 

Mr. Armstrong has been a Washington Post reporter, a member 
of the board of several nonprofits, is the founder of the National Se- 
curity Archive of the George Washington University and co-author 
of a major book on the Supreme Court. 

Our third witness, Suzanne Spaulding, is an authority on na- 
tional security issues, including terrorism, homeland security, crit- 
ical infrastructure protection, cybersecurity, intelligence, law en- 
forcement, crisis management and issues relating to the threats of 
chemical, biological, nuclear and radiological weapons. She just 
knows everything. 

She started working on national security issues on Capitol Hill 
over 20 years ago. More recently, she was the Executive Director 
of two congressionally mandated commissions, the National Com- 
mission on Terrorism, on which I was a member and where I met 
her, and the Commission to Assess the Organization of the Federal 
Government to Combat Proliferation of Weapons of Mass Destruc- 
tion, which was chaired by former CIA Director John Deutch; and 
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she also was the chief of staff to the then minority on the House 
Intelligence Committee when I was the ranking member. 

Welcome back, Suzanne. 

Ms. SPAULDING. Thank you. 

Ms. HARMAN. Our fourth witness, Mark Agrast, is a Senior Fel- 
low at the Center for American Progress, where he focuses on the 
Constitution, separation of powers, terrorism, civil liberties, and 
the rule of law. 

Prior to joining the Center for American Progress, Mr. Agrast 
was counsel and legislative director to Congressman Delahunt of 
Massachusetts. He serves on the 37-member Board of Governors at 
the American Bar Association, past Chair of ABA's section on Indi- 
vidual Rights and Responsibilities, and a former colleague of mine 
in law practice. Very, very knowledgeable about this subject. 

Without objection, all the witnesses' full statements will be in- 
serted in the record; and I would now urge you each to summarize, 
in 5 minutes or less, your principal points. 

We do have a timer. You will see it. It will start blinking at you. 
But it will be much more productive if we can have a conversation 
here, not just having you read from a prepared text. And all of us 
are very eager to learn from you today. 

STATEMENT OF J. WILLIAM LEONARD, DIRECTOR, 
INFORMATION SECURITY OVERSIGHT OFFICE, NATIONAL 
ARCHIVES AND RECORD ADMINISTRATION 

Ms. Harman. Please start, Mr. Leonard. 

Mr. LEONARD. Thank you, Madam Chair, Mr. Reichert, members 
of the subcommittee. I want to thank you for holding this hearing 
today and giving me the opportunity to appear. 

Obviously, the ability and the authority to classify national secu- 
rity information is a critical tool at the disposal of the Government 
and its leaders to protect our Nation and its citizens. 

As with any tool, the classification system is subject to misuse 
and misapplication. When information is improperly declassified or 
not classified in the first place, although clearly warranted, our 
citizens, our democratic institutions, our homeland security, and 
our interactions with foreign nations can be subject to potential 
harm. 

Conversely, too much classification, the failure to declassify infor- 
mation as long as it no longer satisfies the standards for continued 
classification, or inappropriate reclassification unnecessarily ob- 
structs effective information sharing and impedes an informed citi- 
zenry, the hallmark of our democratic form of Government. 

In this time of constant and unique challenges to our national se- 
curity, it is the duty of all of us engaged in public service to do ev- 
erything possible to enhance the effectiveness of this tool. To be ef- 
fective, the classification tool is a process that must be wielded 
with precision. 

Last year, I wrote to all agency heads and made a number of rec- 
ommendations for their consideration. Collectively, these rec- 
ommendations help preserve the integrity of the classification sys- 
tem, while at the same time reduce inefficiencies and cost. They in- 
cluded things such as emphasizing to all authorized holders of clas- 
sified information the affirmative responsibility they have under 
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the order to challenge the classification status of information they 
believe is improperly classified. 

I also suggested requiring the review of agency procedures to en- 
sure that they facilitate classification challenges. In this regard, 
agencies were encouraged to consider the appointment of impartial 
officials ombudsmen, if you will, whose sole purpose is to seek out 
inappropriate instances of classification and to encourage others to 
adhere to their individual responsibility to challenge classification 
as appropriate. 

Also, I suggested ensuring that quality classification guides of 
adequate specificity and clarity are absolutely necessary in order to 
insure accurate and consistent derivative classification decisions. 

In this letter, I also suggested ensuring the routine sampling of 
recently classified products to determine the propriety of classifica- 
tion and the application of proper and full markings. Agency in- 
spector generals, for example, could be involved in this process. 

Consideration should also be given to reporting the results of 
these reviews to agency personnel as well as to officials designated 
who would be responsible to track trends and assess the overall ef- 
fectiveness of the agencies' efforts and make adjustments as appro- 
priate. 

Finally, I suggested that agencies need to ensure that informa- 
tion is declassified as soon as it no longer meets the standards for 
continued classification. 

Again, thank you for inviting me here today, Madam Chair; and 
I would be happy to answer any questions you or the subcommittee 
may have. 

Ms. Harman. Thank you, Mr. Leonard. 

[The statement of Mr. Leonard follows;] 

Ms. Harman. I just want to announce to all that I have to leave 
to return to this markup. I will try to get back. Mr. Carney will 
assume the Chair, because Mr. Langevin has to depart shortly. But 
we will hear testimony from all four of you, and then we will ask 
questions of all four of you. 

Again, I would like to thank you all, but I would like to say to 
you particularly, Mr. Leonard, that you are in a tough fight, and 
your courage and integrity are very impressive. Thank you very 
much. 

Mr. Leonard. Thank you. 

Ms. Harman, Without objection, I will now turn the Chair over 
to Mr. Carney. 

Mr. Carney. [Presiding.] Thank you, Mr. Leonard, for your testi- 
mony. 

Mr. Armstrong. Thank you. 

Mr. Armstrong. I was intending to wish our chairwoman, Mrs. 
Harman, a happy birthday, as today is her birthday, but we can 
sing to her when she returns. 

Mr. Carney. Not me. I want to get re-elected. 

STATEMENT OF SCOTT ARMSTRONG, FOUNDER, 
INFORMATION TRUST 

Mr. Armstrong. I appreciate the opportunity to address these 
issues of classification and pseudo-classification at the Department 
of Homeland Security. 
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My views are my own, but I should note I have been working 
closely within the Aspen Institute to sustain a 6-year dialogue be- 
tween senior journalists, editors and publishers and high-level Gov- 
ernment officials from various national security agencies, including 
senior members of Congress and their staffs. We met from time to 
time with the Director of Central Intelligence and the Attorney 
General and ranking members of the various intelligence bureauc- 
racies. The product of those meetings I think is an agreement that 
the goal is to have a well-informed citizenry that is assured of its 
safety, without sacrificing its liberty. 

The lessons of 9/11 were focused on sharing more information 
within Government agencies, laterally across Government agency 
barriers, and among Federal, State, and local governments and 
with critical private industries, community first responders and the 
public at large. 

The challenge for the Department of Homeland Security is not so 
much how to withhold information or secrets from the public but 
how to share information so as to promote our security. For once, 
the Government's first mission is not to silence leaks but to effec- 
tively share official information outside of its usual constraints. 

The discipline of controlling information needs to give way to the 
creative task of selectively selecting previously withheld informa- 
tion and pushing it rapidly and articulately out to the extraor- 
dinarily varied organizations that protect us, from local law en- 
forcement, first responders, medical and emergency response 
teams, community leaders, utility industry managers with nuclear 
facilities, or farms of chemical and electrical storage tanks, mass 
transportation, and on and on. 

Homeland security requires the vigilance of the many, rather 
than the control of the few. Awareness, prevention, protection, re- 
sponse and recovery are not hierarchical tasks delegated or dic- 
tated from the top. 

The National Intelligence Reform Act of 2004 allowed — in that 
Congress took a major step to address these needs. It authorized 
broad central power for the new Director of National Intelligence 
and urged the DNI to create a tear-line report system, in which in- 
telligence gathering by agencies is prepared so that information re- 
lating to intelligence sources and methods is easily severable with- 
in multi-layered products to allow wide sharing, while still pro- 
tecting truly sensitive sources and methods from unauthorized dis- 
closure. 

The benefit of the protection to our communities lies on the other 
side of that tear-line. By concentrating on classification guidelines 
for protecting well-defined sources and methods and making re- 
fined decisions to protect that which really, truly require protec- 
tion, more of the remaining information will be available for shar- 
ing with the public. 

Your attention today follows a series of extraordinary efforts by 
this administration to control information with such severity and 
vengeance that it has blinded its constitutional partners here and 
in the judiciary. Most startling, this administration has used the 
information controls to institute policy and decision-making layers 
which have deemed even senior departmental officials from work- 
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ing — have doomed them to working in the sort of isolated stove- 
pipes that are repeated again and again in the lessons of 9/11. 

The practices that I have outlined in my prepared statement of 
DHS that have frustrated this effort can be read there. But I em- 
phasize that it is DHS that is the place to start. By adopting legis- 
lative features, you can directly address your interests. Give DHS 
near-term objectives and extra resources to achieve results. Hold 
the Secretary of Homeland Security accountable for the mandates 
already contained in the law which dispensed such sweeping 
power. 

The DNI has the authority to mandate DHS as a test-bed and 
to direct other departments and agencies to cooperate in changing 
the range of intelligence information controls. Hold the DNI ac- 
countable for regularly measuring achievements within the organi- 
zations under his control. Provide built-in monitoring by inde- 
pendent and experienced observers, such as Bill Leonard and the 
Information Security Oversight Office and Public Interest Declas- 
sification Board. 

The tear-line system defined by Congress 4 years ago is the right 
standard. It is the place to start. It needs major attention to stand- 
ardize guidance materials which can be applied with precision. 
Training and performance evaluation is necessary throughout. 

But, most of all, demand and reward less information control in 
order to maximize communication. Translate the classification 
guides that Mr. Leonard referred to into action directives about 
what and how Congress — what and how should be communicated, 
rather than simply whether information might be classified and de- 
controlled. Hold Government officials and employees accountable 
for their decisions. When mistakes come to light, reeducate and re- 
train and emphasize the importance of the supervisors in that proc- 
ess. 

Lastly, encourage the Office of the DNI and the full range of 
agencies under the DNI authority. This includes, not limited to 
DHS, to take careful cognizance of the well-established tradition of 
background briefings in which national security officials and the 
news media communicate informally in a manner meant to inform 
the public, including Congress and others in the executive, and pro- 
vide a degree of confidence that secrecy is not being used to erode 
or impede civil liberties and free expression. 

We would all do well to recall that our freedom has been pro- 
tected and our homes have been secure because we as a people 
have understood how to best share information and how to best re- 
spond together to mutual threats. We look forward to cooperating 
with you in that effort. 

Thank you. 

Mr. Carney. Thank you, Mr. Armstrong. 
[The statement of Mr. Armstrong follows:] 

Prepared Statement of Scott Armstrong 

June 28, 2007 

Chairwoman Harman, Ranking Member Reichert, and members of the Com- 
mittee, thank you for this opportunity to address the issues of classification and 
pseudo-classifi cation at the Department of Homeland Security. 
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My views today are my own, but I should note that I have been working closely 
with the Aspen Institute to sustain a six-year Dialogue between senior journalists, 
editors and publishers and high level US government officials from various national 
security and intelligence agencies, including senior members of congress and their 
staffs. The Dialogue on Journalism and National Security has attempted to address 
recurring concerns about the handling of sensitive national security information by 
government officials and representatives of the news media. The discussions have 
included the Attorney General, the Director of the Central Intelligence Agency and 
ranking officials from the National Security Council, the Department of Defense, the 
National Security Agency, the FBI as well as the CIA and the Department of Jus- 
tice. 

The Dialogue grew out of mutual concerns that legislation passed by both Houses 
of Congress in 2000 was, in effect, America's first Official Secrets Act. Although ve- 
toed by President Clinton, the bill was reintroduced in 2001. In the wake of 9/11, 
high ranking officials of the national security community and the leadership of na- 
tional press organizations recognized that the disclosure of sensitive national secu- 
rity information was a reason for concern. We found considerable agreement that 
legislation which inhibited virtually all exchanges of sensitive information -even re- 
sponsible exchanges designed to increase public appreciation of national security 
issues was not likely to make America more secure. 

The goal, we seemed to agree, has been to have a well-informed citizenry that is 
assured of its safety without sacrificing its liberty. The lessons of 9/11 focused on 
sharing more information within government agencies, laterally across federal agen- 
cy barriers and among federal, state, local governments and with critical private in- 
dustries, community first responders and the public at large. 

The Homeland Security Information Sharing Act, first passed by the House in 
2002 and incorporated into the Homeland Security Act of 2004, 1 mandated the cre- 
ation of a unique category of information known as "sensitive homeland security in- 
formation." This category of SHSI information as we have transliterated the acro- 
nym was designed to permit the sharing of certain critical information with state 
and local authorities without having to classify it and require its recipients to hold 
clearances thus creating new barriers to communication. At the same time, SHSI 
designates information deemed necessary to withhold briefly from the general public 
while appropriate measures are taken to protect our communities. 

The challenge for the Department of Homeland Security is not so much how to 
WITHHOLD secrets from the public and its local governmental representatives. The 
challenge is how«to SHARE information so as to promote our security. For once gov- 
ernment's first mission is not to silence 'leaks," but to effectively share official infor- 
mation outside its usual restraints. 

The discipline of controlling information needs to give way to the creative task 
of selecting previously withheld information and pushing it rapidly and articulately 
out to the extraordinarily varied organizations that protect us: local law enforce- 
ment; first, responders; medical and emergency response teams; community leaders; 
utility industry managers with nuclear facilities or farms of chemical and energy 
storage tanks; mass transportation operators, and so forth. 

Homeland security requires the vigilance of the many rather than the control of 
the few. Awareness, prevention, protection, response and recovery are not hier- 
archical tasks dictated from the top. Secrecy must yield to communication. This is 
no trivial task. The mission of information sharing is difficult enough within the 
cumbersome and slumbering giant newly merged from dozens of agencies and popu 
lated more than 180,000 employees. But that job is only the beginning since D1IS 
is the focal point for leveraging some 87,000 different governmental jurisdictions at 
the federal, state, and local level which have homeland security responsibilities in- 
volving tens of millions of Americans whose responsibilities cannot be 
choreographed from afar, but must be inspired by shared inf onnation. 

In the National Intelligence Reform Act of 2004, the Congress took another major 
step to address this phenomenon. 1 1 authorized broad centralized power for the new 
Director of National Intelligence and urged the new DNI to create a tear line report 
system by which intelligence gathered by an agency is prepared so that the informa- 
tion relating to intelligence sources and methods is easily severable within multiple 
layered products to allow wide sharing while protecting truly sensitive sources and 
methods from unauthorized disclosure. 

The benefit to the protection of our communities lies on the other side of that 
"tear line" system. By concentrating on the classification guidelines for protecting 
well defined sources and methods and making refined decisions to protect that 
which truly requires protection, more of the remaining information should be avail 
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able for sharing within the intelligence community as well as within the diversified 
and distributed elements of the colossus of those charged with Homeland Security 
responsibilities. The public benefits from these designations within internally pub 
lished intelligence requiring protection because it makes majority of fact and anal- 
sis available for expedited release not just to homeland security organizations 
ut also to the media and the public. 

Your attention today follows a series of extraordinary efforts by this administra- 
tion to control inf ormation with such seventy and vengeance that it has blinded its 
constitutional partners here and in the judiciary. Most startling, this administration 
has used these information controls to institute policy and decision making layers 
which have doomed even senior departmental officials to work in the sort of isolated 
stovepipes described in the repetitious texts of 9/11 failures. 

This is no longer a question of issues of over-classification but one of wholesale 
compartmentalized control and institutionalized intimidation through the use of 
draconian Non Disclosure Agreements. It appears designed more to inhibit and con- 
stipate internal communications in the federal government than to protect the na- 
tional security. 

Not surprisingly, the Department of Homeland Security wasted no time in repli- 
cating the move to Non Disclosure Agreements (NDA's). But it combined it with an 
effort to side step the congressional mandate to foster information sharing. Rather 
than educate the rest of the government on how to effectively communicate informa- 
tion, DHS dispersed new information control authority across the full spectrum of 
executive agencies. The uncoordinated proliferation of Sensitive But Unclassified 
designations -of the sort you address today already includes some remarkable 
missteps. 

In one instance, the Department of Homeland Security drafted a draconian Non- 
Disclosure Agreement (NDA) designed to impose restrictions on tens of thousand 
federal employees and hundreds of thousands of state and local first responders. 
This NDA » for unclassified information more severe than the NDA's covering Sen- 
sitive Compartmented Information and even more sensitive information under the 
government's control. 

This NDA required officials, employees, consultants and subcontractors to protect 
such "sensitive but unclassified information," which is defined as "an over arching 
term that covers any information. . . which the loss of, misuse of, or unauthorized 
access to or modification of could adversely affect the national interest or the con- 
duct of Federal programs, or the privacy [of] individuals . . . but which has not 
been specifically authorized under criteria established by an Executive Order or an 
Act of Congress to be kept secret in the interest of national defense or foreign policy. 
This includes information categorized by DHS or other government agencies as: For 
Official Use Only (FOUO); Official Use Only (OUO); Sensitive Homeland Security 
Information (SHSI); Limited Official Use (LOU); Law Enforcement Sensitive (LES); 
Safeguarding Information (SGI); Unclassified Controlled Nuclear Information 
(UCNI); and any other identifier used by other Government agencies to cat- 
egorize information as sensitive but unclassified." 

This overbroad but legally binding requirement was implemented as a condi- 
tion of access to certain unclassified information. Such an NDA represented a vast 
increase in government secrecy. It left control in the hands of an undefined and vir- 
tually unlimited number of supervisors. Those who signed the agreement were 
bound perpetually until it was explicitly removed. The NDA had no statutory au- 
thority and thus no defined criteria, rules, limitations or effective oversight. Al- 
though it did not provide an explicit rationale for withholding "Sensitive But Un- 
classified" information under the Freedom of Information Act, it surely provided an 
incentive to en* in favor of using other exemptions to deny release. 3 

Although this NDA was withdrawn by DHS in January 2005, it was used last 
year at the Department to silence private Wackenhut guards who were speaking to 
the press about security breakdowns at the Department's Nebraska Avenue head- 
quarters. Other instances of SBU constraints by government agencies, contractors 
and utilities appear to be used most often to discourage and prevent the public from 
participating in its government. Provisions similar to the DHS NDA have since ap- 
peared in other employee and contractor agreements both within DIIS and within 
other departments. 4 



2 DHS Form 11000 6 (08-04) "NON-DISCLOSURE AGREEMENT*. 

3 See also DHS directive (MD 11042) on "Safeguarding Sensitive But Unclassified (For Official 
Use Only) Information," dated May 11, 2004. 

^See CRS Report RL33303, "Sensitive But Unclassified" Information and Other Controls: Pol- 
icy and Options for Scientific and Technical Information, February 15, 2006 Genevieve J. Knezo, 
Specialist in Science and Technology Policy, Resources, Science, and Industry Division. 
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I repeat the details of DHS's failed practices to underline the suggestion that DHS 
is dramatically out of synch with its mandate to increase our security at home by 
aggressively— and yet carefully — -sharing information in order to frustrate terrorists 
through prepared and coordinated responses of the most sophisticated intelligence 
capabilities on one hand, and our most formidable first line of defense — local law 
enforcement and first responders, on the other hand. 



Adopt into legislation features which directly address your intentions. 

1. DHS is the right place to begin. The current classification system within 
government is out of control and likely uncontrollable. Someone needs to start over 
with a new test bed. DHS, with its critically mission of communicating effectively 
across the federal government and with all other layers of state and local 
institutionsm has the greatest incentive for change. 

2. Give DHS near-term objectives and extra resources to achieve concrete re- 
sults. Hold the Secretary of Homeland Security accountable for the mandates con- 
tained in the law which dispensed such sweeping power. 

3. The DNI has the authority to mandate DHS as a test-bed and to direct other 
departments and agencies to cooperate in changing the range of intelligence and in- 
formation control systems. Hold the DNI accountable by regularly measuring 
achievements within organizations under his control. 

4. Provide built-in monitoring by independent and experienced observers such 
as the Information Security Oversight Office and the Public Interest Declas- 
sification Board and provide the monitors with the resources to do their job. 

5. The tear-line system designated by Congress four years ago is the right stand- 
ard. It needs major attention to standardize guidance materials which can be ap- 
plied with precision. All intelligence publication and sharing should be premised on 
carefully and formally defining sources and methods which require protection by iso- 
lating the smallest number of critical details. Information which requires less pro- 
tection will receives greater circulation and earlier decontrol. 

6. Provide training and performance evaluation incentives throughout all lev- 
els of DHS, in order to assure that the information which needs tight sources and 
methods control and only that information receives the ultimate protection. 

7. Create an electronic metadata tagging system which requires that rigorous 
classification decision making will follow established guidance. Use it to assure that 
all levels understand they must conform with established practice and their effec- 
tiveness can and will be calibrated. Such a tagging system not only improves ac- 
countability, but also allows corrections and the protection of information improp- 
erly handled. 

8. Demand and reward less information control in order to maximize commu- 
nication. 

Changing goals require reinforcement that professionalizes every level and 
every aspect of the inf ormation control process. 

• Translate Information Control Guides (Classification Guides) into action di- 
rectives about what and how to communicate rather than simply what 
and when information might be declassified or decontrolled. 



nisms to make sure that the communication runs to, as well as from, all 
intended recipients. 
9. Hold government officials and employees accountable for their deci- 
sions. 

• When mistakes come to light, reeducate and retrain. 

• Rethink the scope and purpose of both past practices and contemporary inno- 
vations by insisting managers manage the process with a willingness to keep 
changing procedures until they truly work. 

• Remove authority from those who abuse it. 

• Hold supervisors responsible by requiring them to assume additional 
monitoring and training responsibilities if those reporting to them fail 
to perform well-defined and specifically designated responsibilities. Similarly re- 
ward them when their aides perform their communication roles well. 

• End the incentive to classify simply because over classifying has no con- 
sequences to individuals but information released can be career ending. 

• Institute pro active audits and correlated retraining. 

• Allow government employees and motivated citizens such as users of the 
FOIA to bring mistakes to light. Follow-up in a transparent manner to dem- 
onstrate that improved communication and improved information controls are 



The Necessary Response 
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not necessarily on separate planes but are integrated concerns of all stake 

holders in a democracy. 
10. Encourage the Office of the DNI and full range of Agencies under DNI author- 
ity including but not limited to DHS to take careful cognizance of the well es- 
tablished tradition of background briefings in which national security offi- 
cials and the media communicate informally in a manner meant to inform the 
public (including the Congress and others in the Executive) and provide a degree 
of confidence that secrecy is not being used to erode or impede civil liberties and 
free expression. 

• Include training for national security officials on responsible interaction with 
the news media by including the news media in the training 

• Offer the media opportunities to learn about the laws, regulations and 
practices which involve secrecy and other national security protocols. 

We would all do well to recall that our freedom has been protected and 
our homes have been secure because— as a people — we have understood 
how to best to share information and how best to respond together to mu- 
tual threats. 

Mr. Carney. Ms. Spaulding for 5 minutes, please. 

STATEMENT OF SUZANNE E. SPAULDING, PRINCIPAL, 
BINGHAM CONSULTING GROUP LLC 

Ms. Spaulding. Thank you, Chair, ranking member and mem- 
bers of the committee. I very much appreciate this opportunity to 
be here today to testify about classification issues at the Depart- 
ment of Homeland Security. It is a very important issue, and I 
commend the committee for making it a priority. 

In my 20 years working national security issues for the Govern- 
ment, I have seen firsthand how important it is to get this classi- 
fication issue right. It may seem counterintuitive to some, but 
avoiding overclassifi cation is essential to protecting vital national 
security secrets. Those handling classified documents will have 
greater respect for that Top Secret stamp if they know that things 
are only classified when they their disclosure will truly harm na- 
tional security. 

When things are classified that clearly would not harm national 
security, it tempts some individuals to believe that they can decide 
what is really sensitive and what is not. Now let me be clear that, 
in making that observation, I am in no way trying to excuse the 
disclosure of classified information, merely to note that the risk of 
leaks I believe is heightened by overclassifi cation. 

A similar phenomenon follows the increasingly common practice 
of selective declassification by Government officials. Strategic and 
carefully considered decisions to make previously classified infor- 
mation available to the public can be important in increasing 
transparency. But when the disclosures appear to be designed to 
advance a particular political agenda or to gain an advantage in a 
policy dispute, it again undermines the respect for and confidence 
in the classification system. And this risk is heightened when the 
declassification is done selectively, so as to reveal only intelligence 
that supports one side of the issue, leaving contrary intelligence 
classified. 

It is equally essential for our national security that information 
that can be shared without jeopardizing national security is not 
prevented by overclassiflcation from getting to those who need it 
and could make use of it. 

It is appropriate that the committee has decided to begin with 
an effort to make the Department of Homeland Security the gold 
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standard for reducing overclassiflcation, because it is DHS that 
faces the most significant imperative to provide relevant informa- 
tion to a wide range of users, including those at the State and local 
level, the private sector, and even within DHS who are not tradi- 
tional members of the national security community and are un- 
likely to hold security clearances. If information is unnecessarily 
restricted, it threatens homeland security by hampering the ability 
of these key players to contribute to the mission. 

I know the committee is considering a number of ideas, a number 
of which have already been articulated here today, and I think 
these are very sound suggestions. There are additional near-term 
and longer-term steps that the committee might also consider. 

One, require that intelligence documents be written in an unclas- 
sified version first to the maximum extent possible. Rather than 
creating a tear-line of unclassified or less sensitive information at 
the bottom of a document, why not set up the system so that no 
classified document can be prepared without first entering informa- 
tion into the unclassified section at the top of the document? This 
exercise could prompt a more careful effort to distinguish between 
truly classified information and that which can be shared more 
broadly and provide a visual reinforcement of the importance of 
writing in an unclassified form. 

Two, enforce portion marking. This used to be the standard prac- 
tice, where each paragraph was determined to be whether it was 
classified or unclassified. We have drifted away from that, and I 
think we should go back to really enforcing that requirement. 

Three, use technology to tag information as it moves through the 
system. This provides even greater granularity than the paragraph 
portion marking, indicating which precise bits of information are 
classified. And then these tags, perhaps embedded in metadata, 
can move through the system with that information, facilitating the 
production of less classified documents. 

Reverse the incentive to overclassify. This will not change until 
performance evaluations consider classification issues. It should be 
a specific factor when employees are evaluated for moving up or for 
raises. Employees who routinely overclassify should be held ac- 
countable and receive additional training, and employees should be 
rewarded for producing reports that can be widely disseminated. 

Five, identify key Federal, State and local officials who can re- 
ceive relevant classified information by virtue of their office, rather 
than by having to get a clearance. This is how we have always han- 
dled it for Members of Congress. More recently, we have included 
Governors; and DHS should consider extending it to other key offi- 
cials. 

And, six, develop innovative ways of sharing information without 
handing over documents; and I have got some specifics on that in 
my prepared testimony. 

In conclusion, these are just a few ideas, based on practical expe- 
rience working in the classified environments for nearly 2 decades. 
I know the committee is aware of the outstanding work of the 
Markle Foundation and others, and I recommend those to your con- 
sideration as well. 

The problem of overclassiflcation is an enduring one and presents 
a daunting challenge. The committee is to be commended for taking 
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up that challenge and endeavoring to set a new standard at DHS, 
and I appreciate the opportunity to contribute to that effort. 
Thank you. 

Mr. Carney. Thank you, Ms. Spaulding. 
[The statement of Ms. Spaulding follows:] 

Prkpared Statement of Suzanne E. Spaulding 

June 28, 2007 

Chairwoman Harman, Ranking Member Reichert, and members of the Com- 
mittee, thank you for this opportunity to testify today about classification issues at 
the Department of Homeland Security. This is an important issue and I commend 
the committee for making it a priority. 

I was fortunate enough to spend 20 years working national security issues for the 
government, including 6 years at CIA and time at both the Senate and House Intel- 
ligence Committees. I have seen first hand how important it is to get the classifica- 
tion issue right. 

It may seem counterintuitive to some, but avoiding over classification is essential 
to protecting vital national security secrets. Those handling classified documents 
will have greater respect for that "Top Secret" stamp if they know that things are 
only classified when their disclosure would truly harm national security. When 
things are classified whose disclosure clearly would not harm national security, it 
tempts some individuals to believe that they can decide what is really sensitive and 
what is not. This could apply to employees in the intelligence community or others, 
such as members of the media, who receive classified documents. In making this ob- 
servation, I certainly do not mean in any way to excuse the disclosure of classified 
information, merely to note that the risk of leaks is heightened by over classifica- 
tion. 

A similar phenomenon follows the increasingly common practice of "selective de- 
classification" by government officials. This selective declassification can be accom- 
plished either by unofficial leaks to the media or by ollicial decisions to declassify 
material. Strategic and carefully considered decisions to make previously classified 
information available to the public can be an important and effective way of increas- 
ing the transparency that is so vital for a functioning democracy. However, when 
the disclosures appear to be designed to advance a particular political agenda or to 
gain advantage in a policy dispute, it again undermines the respect for and con- 
fidence in the classification system. An employee or reporter who sees senior offi- 
cials deciding that classification isn't as important as their particular agenda may 
be emboldened to make similar decisions. This risk is heightened when the classi- 
fication is done selectively so as to reveal only intelligence that supports one side 
of the issue, while leaving contrary intelligence classified. 

Just as getting the classification process right is vital for protecting true secrets, 
it is essential that information that can be shared without jeopardizing national se- 
curity is not prevented by over classification from getting to those who could make 
use of it. As the 9/11 Commission Report made clear, this is particularly urgent for 
our counterterrorism efforts. 

It is appropriate that the Committee has decided to begin with an effort to make 
the Department of Homeland Security the "Gold Standard" for reducing over-classi- 
fication, since DHS faces the most significant imperative to provide relevant infor- 
mation to, and receive and analyze information from, a wide range of users who are 
not traditional members of the national security community. Key players at the 
state and local level, in the private sector, and within DHS? own entities, are un- 
likely to have clearances. Yet they serve vital roles in protecting the homeland and 
can provide, benefit from, and help analysts to better understand, information that 
is gathered overseas and in the US. If this information is unnecessarily restricted, 
it threatens homeland security by hampering the ability of these key players to con- 
tribute to the mission. 

I know that the committee is considering a number of ideas, including a certifi- 
cation process to ensure that those who have authority to classify documents ai*e 
properly trained to recognize when information is truly sensitive and regular audits 
of existing classified documents to assess the scope and nature of any over classifica- 
tion. I think these are sound suggestions. There are additional near term and 
longer term steps that the Committee might also consider. 

1. Require that documents be written in unclassified version first, to the 
maximum extent possible. Traditional practice in the intelligence community has 
been to prepare a classified document reflecting the intelligence and then, if dis 
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semination to non cleared individuals was required, to prepare an unclassified 
version at the bottom of the document after a "tear line." These are known as "tear 
sheets;" the recipient would tear off the bottom portion to provide to the un cleared 
recipient. Instead, to facilitate the admonition to move from a "need to know" to a 
"need to share" culture what the Markle Foundation called a "culture of distribu- 
tion" why not set up the system so that no classified document can be prepared 
without first entering inf ormation in the unclassified section at the top of the docu- 
ment. There may be times when almost nothing can be put it the unclassified por- 
tion, but the exercise could prompt more careful effort to distinguish between truly 
classified information and that which can be shared more broadly. And putting the 
unclassified version at the top visually reinforces the shift in priorities. 

2. Enforce "portion marking*" It used to be standard practice that each para- 
graph of a document had to be individually determined and marked as classified or 
unclassified. This requires more careful consideration of what information is actu- 
ally sensitive and assists in any later efforts to provide an unclassified version of 
the document. My sense is that, over time, documents are increasingly classified in 
their entirety, with no portion marking, making it far more difficult and cum- 
bersome to "sanitize" the information for wider dissemination. A simple immediate 
step would be to enforce the requirement for portion marking for every classified 
document. 

3. Use technology to tag information as it moves through the system. The 
optimum system would provide even greater granularity than the paragraph portion 
marking, indicating what precise bits of information are classified. These classifica- 
tion "tags" perhaps imbedded in metadata would then move with the information 
as it flows through the system and facilitate the preparation of unclassified versions 
of documents. The more precisely we can isolate truly sensitive information, the 
easier it will be to identify and disseminate unclassified information. 

4. Reverse the "default" incentive to over-classify. Virtually all of the incen- 
tives today are in favor of over classification. The danger of not classifying informa- 
tion that is indeed damaging to national security is well understood. What is not 
as widely appreciated in the national security risk of over classification. Thus, there 
are effectively no penalties in the system for an individual decision to classify un- 
necessarily. This will not change until performance evaluations consider classifica- 
tion issues. Regular audits can provide insight into individual patterns as well as 
overall agency performance, for example. Employees who routinely over -classify 
should be held accountable and receive additional training. And employees should 
be rewarded for producing reports that can be widely disseminated. In addition, the 
system should make it easy to produce unclassified documents and require a bit 
more effort to classify something. Requiring that unclassified documents be written 
first and enf orcing the requirement for portion marking are some examples. Requir 
ing that the specific harm to national security be articulated in each case might be 
another possibility, although it is important not too make the system so cum- 
bersome that it undermines the ability to be quick and agile when necessary. Ulti- 
mately, you want a process that makes it harder to go around the system that to 
use it. 

5. Identify key federal, state, and local officials who can receive relevant 
classified information by virtue of their office rather than having to get a 
clearance. This is how it has always worked with Members of Congress. More re- 
cently, this was adopted as the policy for governors. DHS should consider extending 
this to other key officials. 

6. Develop innovative ways of sharing information without handing over 
documents. Ultimately, the key is to enhance understanding and knowledge. Too 
much emphasis is sometimes placed on sharing documents, rather than on sharing 
ideas, questions, and insights gleaned from those documents. This can often be done 
without revealing the sensitive information in the documents. In addition, when 
dealing with unclassified but sensitive information, such as business proprietary in- 
formation, DHS could consider "partnership panels" where the government and 
business would come together in a neutral space, share information such as vulner- 
ability assessments and threat information, so as to enhance mutual understanding 
and benefit from each others insights, but then leave the space without having 
handed over the documents. 

These are just a few ideas based on practical experience working in classified en- 
vironments for nearly two decades. I know that the Committee is aware of the out- 
standing work by the Markle Foundation and others in developing recommendations 
for improving information sharing and will take those under consideration as well. 

The problem of over-classification is an enduring one and presents a daunting 
challenge. This Committee is to be commended for taking up that challenge and en 
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deavoring to set a new standard at DIIS. I appreciate the opportunity to contribute 
to that important effort. 

Mr. Carney. Mr. Agrast, please summarize for 5 minutes. 

STATEMENT OF MARK AGRAST, SENIOR FELLOW, CENTER 

FOR AMERICAN PROGRESS 

Mr. AGRAST. Thank you, Mr. Carney. 

My name is Mark Agrast. I am a Senior Fellow at the Center for 
American Progress, where I focus on civil liberties and national se- 
curity concerns; and I previously spent a decade on Capitol Hill. 

Most Americans understand and accept the need to protect Gov- 
ernment information whose disclosure would endanger the Nation's 
security. But as the 9/11 Commission found, too much secrecy can 
put our Nation at greater risk, hindering oversight, accountability 
and information sharing, concealing vulnerabilities until it is too 
late to correct them, and undermining the credibility of the classi- 
fication system itself. 

Ten years ago, the Moynihan Commission concluded secrets 
could be protected more effectively if secrecy is reduced overall. Un- 
fortunately, while the Clinton Administration made much headway 
in reducing unnecessary secrecy, today we are moving in the oppo- 
site direction. There were nearly three times as many classification 
actions in 2004 as in the last year of the Clinton Presidency; and 
while President Clinton declassified nearly a billion pages of histor- 
ical material, the pace has slowed to a trickle in the last 6 ars. 

Today's epidemic of overclassification stems in part from rules 
that resolve all doubts in favor of nondisclosure and in part from 
standards so hard to administer that even skilled classifiers often 
get it wrong. Sometimes material is classified only to suppress em- 
barrassing information. 

Take the decision to classify the Taguba Report on prisoner 
abuse at Abu Ghraib. A reporter who had seen a copy of that report 
asked Secretary Rumsfeld why it was marked Secret. You would 
have to ask the classifier, Rumsfeld said. Or the decision to reclas- 
sify a 1950 intelligence estimate written only 12 days before Chi- 
nese forces entered Korea, predicting Chinese entry in the conflict 
was not probable. 

Still, despite such failures, at least there are rules what can be 
classified, for how long and by whom. The same cannot be said for 
the designations used by Federal agencies to deny access to sen- 
sitive but unclassified information. Few of these pseudo-classifica- 
tions have ever been authorized by Congress. They allow virtually 
any employee, and even private contractors, to withhold informa- 
tion that wouldn't even rate a Confidential stamp, with few stand- 
ards or safeguards to prevent error and abuse. 

As the Chair noted, last Sunday's Washington Post described a 
pseudo-classification scheme invented by the Vice President him- 
self. His office has been giving reporters documents labeled treat 
as Top Secret/SCI, an apparent attempt to treat unclassified mate- 
rial as though it were Sensitive Compartmented Information, a 
special access designation reserved for secrets whose disclosure 
would cause exceptionally grave damage to national security. 

I commend the committee, the subcommittee for its commitment 
to doing the oversight that is so long overdue; and I hope you won't 
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stop at oversight. It has been 10 years since the Moynihan Com- 
mission urged Congress to legislate the rules that protect national 
security information, rather than leaving it up to the executive 
branch to police itself. It is time for Congress to take up that chal- 
lenge. 

In some cases, this will require Government-wide solutions. For 
example, Congress could and should reinstate the presumption 
against classification in cases of significant doubt, the Clinton era 
policy which the Moynihan Commission urged Congress to codify. 

Congress should also rein in the use of pseudo-classification, at 
a minimum prohibiting agencies from adopting unclassified des- 
ignations that are not expressly authorized and mandating strict 
standards for any designations it does authorize to minimize their 
impact on public access. 

Better still. Congress could refrain from authorizing unclassified 
designations in the first place. Such powers are all too easily given; 
and, once they are in place, it is virtually impossible to get rid of 
them. 

Finally, Congress can take steps to reform the system one agency 
at a time by initiating reforms at the Department of Homeland Se- 
curity. By making DHS the gold standard, Congress can promote 
best practices throughout the system. 

My full statement includes recommendations to improve over- 
sight of the classification system at DHS and to reduce the harmful 
effects of pseudo-classification as well. I would just review a couple 
of those in the half a minute or so that I have left. 

I would recommend that Congress establish an independent DHS 
Classification Review Board to ensure that information is declas- 
sified as soon as it no longer meets the criteria for classification. 
Congress should establish an independent ombuds office within 
DHS to assist with declassification challenges and requests for de- 
classification. It should require the DHS Inspector General to con- 
duct periodic audits of the DHS classification program and report 
to Congress on the appropriateness of classification decisions. And 
it should require DHS to implement a system of certification for 
DHS officials with classification authority and to provide them with 
training and proper classification practices. 

I would refer you to my testimony for recommendations regard- 
ing sensitive information controls. 

I do think that by helping to ensure that the Government keeps 
secret only what needs to be kept secret, these measures and oth- 
ers would enhance both openness and security at DHS and 
throughout the Government. 

Thank you. 

[The statement of Mr. Agrast follows:] 

Prepared Statement of Mark D. Agrast 
June 28, 2007 

Madame Chair, Ranking Member Reichert, and members of the subcommittee, 
thank you for conducting this hearing and inviting me to testify. 

My name is Mark Agrast. I am a Senior Fellow at the Center for American 
Progress, where I work on issues related to the Constitution, separation of powers, 
terrorism and civil liberties, and the rule of law. 

Before joining the Center, I was an attorney in private practice and spent over 
a decade on Capitol Hill, most recently as Counsel and Legislative Director to Con 
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gressman William D. Delahunt of Massachusetts. A biographical statement is ap 
pended to my testimony. 

In an address to the Oklahoma Press Association in February 1992, former Direc- 
tor of Central Intelligence, Robert M. Gates, now the Secretary of Defense, noted 
that the phrase "CIA openness" can seem as much an oxymoron as "government fru- 
gality" and "bureaucratic efficiency.' 

That seeming contradiction in terms illustrates the anomalous role that secrecy 
plays in a democracy that depends so profoundly on an informed and engaged citi- 
zenry. 

At the same time, most Americans understand and accept the need to withhold 
from public view certain national security information whose disclosure poses a gen- 
uine risk of harm to the security of the nation. 

But the events of 9/11 taught us how dangerously naive it would be to equate se- 
crecy with security. As the 9/11 Commission conclude, too much secrecy can put our 
nation at greater risk, hindering oversight, accountability, and information snaring. 

Too much secrecy— whether through over classification or through pseudo-classi- 
fication -conceals our vulnerabilities until it is too late to correct them. 

It slows the development of the scientific and technical knowledge we need to un- 
derstand threats to our security and respond to them effectively. 

It short circuits public debate, eroding confidence in the actions of the govern- 
ment. 

And finally, it undermines the credibility of the classification system itself, en- 
couraging leaks and breeding cynicism about legitimate restrictions. As Associate 
Justice Potter Stewart famously cautioned in the Pentagon Papers case: 

I should suppose that moral, political, and practical considerations would dictate 
that a very first principle of that wisdom would be an insistence upon avoiding se- 
crecy for its own sake. For when eveiything is classified, then nothing is classified, 
and the system becomes one to be disregarded by the cynical or the careless, and 
to be manipulated by those intent on self protection or self -promotion. I should sup- 
pose, in short, that the hallmark of a truly effective internal security system would 
be the maximum possible disclosure, recognizing that secrecy can best be preserved 
only when credibility is truly maintained. 1 

The Commission on Protecting and Reducing Government Secrecy, chaired by 
Sen. Daniel Patrick Moynihan, reached a similar conclusion in its 1997 report: "The 
best way to ensure that secrecy is respected, and that the most important secrets 
remain secret, is for secrecy to be returned to its limited but necessary role. Secrets 
can be protected more effectively if secrecy is reduced overall." 2 

Classification, Declassification and Reclassification 

The Moynihan Commission was created by Congress to consider whether it was 
time to rethink the vast system of secrecy that had been brought into being dining 
the Cold War. The Commission recommended a series of statutory reforms to the 
classification system that were widely praised but never implemented. 

The spirit of the Moynihan recommendations can certainly be discerned in the 
contemporaneous amendments to the classification system that wei*e instituted by 
President Clinton under Exec. Order No. 12958. The order established a presump- 
tion of access, directing that "If there is significant doubt about the need to classify 
information, it shall not be classified." Similarly, the order provided that "If there 
is significant doubt about the appropriate level of classification, it shall be classified 
at the lower level." The Clinton order also: . 

• Limited the duration of classification, providing that where the classifier can- 
not establish a specific point at which declassification should occur, the material 
will be declassified after 10 years unless the classification is extended for suc- 
cessive 10 year periods under prescribed procedures. 

• Provided for automatic declassification of government records that are more 
than two years old and have been determined by the Archivist of the United 
States to have permanent historical value, allowing for the continued classifica- 
tion of certain materials under specified procedures. 

• Established a balancing test for declassification decisions in "exceptional 
cases," permitting senior agency officials to exercise discretion to declassify in- 
formation where "the need to protect such information may be outweighed by 
the public interest in disclosure of the information." 

• Prohibited reclassification of material that had been declassified and released 
to the public under proper authority. 



1 N.Y. Times Co. v. U.S., 403 U.S. 713, 729 (1971) (Stewart, J., concurring). 

2 Report of the Common on Protecting & Reducing Gov^t Secrecy (i997> at xxi {hereinafter 
Moynihan Commission Report!. 
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• Authorized agency employees to bring challenges to the classification status 
of information they believe to be improperly classified. 

• Created an Interagency Security Classification Appeals Panel (ISCAP) to ad- 
judicate challenges to classification and requests for mandatory declassification, 
and to review decisions to exempt information from automatic declassification. 

The changes instituted by President Clinton were largely erased by his successor, 
who issued a revised executive order in 2003. Exec. Order No. 13292 eliminated the 
presumption of access, leaving officials free to classify information in cases of "sig- 
nificant doubt." It also: 

• Relaxed the limitations on the duration of classification, and made it easier 
for the period to be extended for unlimited periods. 

• Postponed the automatic declassification of protected records 25 or more years 
old from April 2003 to December 2006, and reduced the showing that agencies 
must make to exempt historical records from automatic declassification. 

• Revived the ability of agency heads to reclassify previously declassified infor- 
mation if the information "may reasonably be recovered." 

• Allowed the Director of Central Intelligence to override decisions by ISCAP, 
subject only to presidential review. 

The results of this shift in policy are reflected in the annual classification statis- 
tics published by the Information Security Oversight Office (ISOO). The number of 
classification actions by the government hit an all time high of 15.6 million in 2004, 
with only slightly fewer (14.2 million) reported in 2005. This was nearly twice the 
number of classification actions (8.6 million) taken in 2001, the first year of the 
Bush administration, and three times the number (5.8 million) taken in 1996, the 
last year of President Clinton's second term. 3 

As classification actions have soared, declassification actions have plummeted. 
President Clinton oversaw the declassification of more historic materials than all 
previous presidents combined. During his last six years in office, 864 million pages 



the Bush administration, the numbers have fallen precipitously. Only 245 million 
pages were declassified from 2001 2005, with fewer than 30 million pages were de- 
classified in 2005. 4 

Apart from its costs to both openness and security, all this classifying and declas- 
sifying comes at a heavy financial cost as well. In 2005, the cost of securing classi- 
fied information was $7.7 billion, of which only $57 million was spent on declas- 
sification. In all, for every dollar the federal government spent to release old secrets, 
it spent $134 to create new ones. 5 

What the numbers cannot reveal is whether classification decisions are lawf ul and 
appropriate. Estimates of the extent of over classification vary, but I was particu- 
larly struck by Mr. Leonard's testimony before this subcommittee last March, in 
which he said that an audit conducted by the Information Security Oversight Office 
found that even trained classifiers, armed with the most up to date guidance, "got 
it clearly right only 64 percent of the time." 6 

There are also instances in which over classification is the result, not of honest 
error, but of a desire to conceal. Both the Clinton and Bush executive orders pro- 
hibit the use of the classification system to "conceal violations of law, inefficiency, 
or administrative error" or prevent embarrassment to a person, organization, or 
agency." Yet at least some recent classification decisions could have had little pur- 
pose other than to suppress information that might be embarrassing to the govern- 
ment. 

A particularly troubling example is the decision by the Department of Defense to 
classify in its entirety the March 2004 report of the investigation by Maj. Gen. Anto- 
nio M. Taguba of alleged abuse of prisoners by members of the 800th Military Police 
Brigade at Baghdad's Abu Ghraib Prison. According to an investigation by the Mi- 
nority Staff of the House Committee on Government Reform: 

One reporter who had reviewed a widely disseminated copy of the report raised 
the issue in a Defense Department briefing with General Peter Pace, the Vice 
Chairman of the Joint Chiefs of Staff, and Secretary Rumsfeld. The reporter 
noted that 'there's clearly nothing in there that's inherently secret, such as in- 
telligence sources and methods or troop movements' and asked: 'Was this kept 



3 Info, Sec. Oversight Office, NaVl Archives & Records Admin., Report to the Presi- 
dent 2005 at 13. 
at 15. 

5 OpenTheGovernment.org, Secrecy Report Card 2006 at 4. 

G Over-classification and Pseudo-classification: The Impact on Information Sharing: Hearing 
Before the Suocomm, on Intelligence, Information Sharing and Terrorism Risk Assessment of the 
House Comm. on Homeland Sec, 110th Cong. (2007) (statement of J. William Leonard). 
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secret because it would be embarrassing to the world, particularly the Arab 
world?' General Pace responded that he did not know why the document was 
marked secret. When asked whether he could say why the report was classified, 
Secretary Rumsfeld answered: 'No, you'd have to ask the classifier.' 7 
The desire to prevent embarrassment seems also to have played a role in the 
Bush administration's aggressive reclassification campaign. According to a February 
2006 report by the National Security Archive, the administration has reclassified 
and withdrawn from public access 9,500 documents totaling 55,500 pages, including 
some that are over 50 years old. For example: 

• complaint from the Director of Central Intelligence to the State Department 
about the bad publicity the CIA was receiving after its failure to predict anti- 
American riots in Colombia in 1948. 

• A document regarding an unsanctioned CIA psychological warfare program to 
drop propaganda leaflets into Eastern Europe by hot air balloon that was can- 
celed after the State Department objected to the program. 

• A document from spring 1949, revealing that the U.S. intelligence commu- 
nity's knowledge of Soviet nuclear weapons research and development activities 
was so poor that America and Britain were completely surprised when the Rus- 
sians exploded their first atomic bomb six months later. 

• A 1950 intelligence estimate, written only 12 days before Chinese forces en- 
tered Korea, predicting that Chinese intervention in the conflict was "not prob 
able." 8 

These reclassification actions call to mind the observations of the late Erwin N. 
Griswold, former Solicitor General of the United States and Dean of Harvard Law 
School, who argued the Pentagon Papers case before the Supreme Court in 1971. 
Presenting the case for the government, he had argued that the release of the Pen- 
tagon Papers would gravely damage the national security. Nearly two decades later, 
Griswold reflected on the lessons of that case: 

It quickly becomes apparent to any person who has considerable experience 
with classified material that there is massive overclassification and that the 
principal concern of the classifiers is not with national security, but rather with 
governmental embarrassment of one sort or another. There may be some basis 
for short term classification while plans are being made, or negotiations are 
going on, but apart from details of weapons systems, there is veiy rarely any 
real risk to current national security from the publication of facts relating to 
transactions in the past, even the fairly recent past. This is the lesson of the 
Pentagon Papers experience, and it may be relevant now. 

Pseudo-Classification 

For all its faults, the classification system has many virtues as well. Classification 
actions are subject to uniform legal standards pursuant to executive order. These 
actions can be taken by a limited number of officials who receive training in the 
standards to be applied; they are of limited duration and extent; they are monitored 
by a federal oversight olfice; they can be challenged; and they can be appealed. 

The same cannot be said for the potpourri of unclassified control markings used 
by federal agencies to manage access to sensitive government information, most of 
which are defined by neither statute nor executive order, and which collectively 
have come to be known pejoratively as the "pseudo-classification" system. 

Among the better known are Sensitive But Unclassified (SBU), Sensitive Security 
Information (SSI), Sensitive Homeland Security Information (SHSI), Critical Infra- 
structure Information (CII), Law Enforcement Sensitive (LES), and For Official Use 
Only (FOUO). 

While some of these control markings are authorized by statute, 10 others have 
been conjured out of thin air. Some of these pseudo-classification regimes allow vir- 
tually any agency employee (and often private contractors) to withhold information 
without justification or review, without any time limit, and with few, if any, internal 
controls to ensure that the markings are not misapplied. 

A March 2006 report by the Government Accountability Office (GAO) found that 
the 26 federal agencies surveyed use 56 different information control markings (16 



7 Minorhy Staff of House Comm. On the Judiciary, ioTH Cong., Report on Secrecy in 
the Bush Administration (2004) at 50. 

8 MATrHF.w M. Aid, Nai'l Sec. Archive, Deci.assification in Reverse: The U.S. Intel- 
ligence Cmtv*s Secret Historical Document Reclassification Program (2006). 

9 Erwin N. Griswold, Secrets Not Worth Keeping: The Courts and Classified Information, 
Wash. Post, Feb. 15, 1989, at A25. 

10 See, e.g., Aviation and Transp. Sec. Act, Pub. L. No. 107-71; Fed. Info. Sec. Act, Pub. L, 
No. 107-347; Homeland Sec. Act, Pub. L. No. 107 296; Critical Infrastructure Info. Act, Pub. 
L. No. 107 296. 
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of which belong to one agency) to protect sensitive unclassified national security in- 
formation. The GAO also found that the agencies use widely divergent definitions 
of the same controls. 11 

According to the GAO report, the Department of Homeland Security (DHS) em- 
ploys five of these control markings: For Official Use Only (FOUO) (agency wide); 
Law Enforcement Sensitive (LES) (agency-wide); Limited Official Use (LOU) (U.S. 
Secret Service); Protected Critical Infrastructure Information (PCII) (Directorate for 
Preparedness); and Sensitive Security Information (SSI) (Transportation Security 
Administration and U.S. Coast Guard). 

The department's approach to the use of these designations is set forth in a DHS 
management directive regarding the treatment of sensitive but unclassifi ed informa- 
tion originating within the agency. 12 The directive is chiefly concerned with the For 
Official Use Only designation, which it says will be used "to identify sensitive but 
unclassified information within the DHS community that is not otherwise specifi- 
cally described and governed by statute or regulation." The directive identifies 11 
categories of SBU information that can be designated as FOUO, and provides that 
the designation can be made by any DHS employee, detailee, or contractor and will 
remain in effect indefinitely until the originator or a management official deter- 
mines otherwise. 

For good measure, the directive notes that where other agencies and international 
organizations use similar terminology but apply different requirements to the safe 
guarding of the information, the information snould be treated in accordance with 
whichever requirements are the more restrictive. 

A 2004 report by the JASON Program Office at MITRE Corporation suggests that 
the designation authorities at DHS are not atypical: "'Sensitive but unclassified' 
data is increasingly defined by the eye of the beholder. Lacking in definition, it is 
correspondingly lacking in policies and procedures for protecting (or not protecting) 
it, ana regarding how and by whom it is generated and used." 13 

As in the case of classification and reclassification actions, these designations 
have at times been used not to protect legitimate national security secrets, but to 
spare the government from embarrassment. In a March 2005 letter to Rep. Chris- 
topher Shays, then the Chairman of the House Committee on Government Reform, 
Rep. Henry Waxman cited examples in which: 

• The State Department withheld unclassified conclusions by the agency's In- 
spector General that the CIA was involved in preparing a grossly inaccurate 
global terrorism report. 

• The State Department concealed unclassified information about the role of 
John Bolton, Under Secretary of State for Arms Control, in the creation of a 
fact sheet that falsely claimed that Iraq sought uranium from Niger. 

• The Department of Homeland Security concealed the unclassified identity and 
contact information of a newly appointed TSA ombudsman whose responsibility 
it was to interact daily with members of the public regarding airport security 
measures. 

• The CIA intervened to block the chief U.S. weapons inspector Charles A. 
Duelfer, from revealing the unclassified identities oi U.S. companies that con- 
ducted business with Saddam Hussein under the Oil f or Food program. 

• The Nuclear Regulatory Commission sought to prevent a nongovernmental 
watchdog group from making public criticisms of its nuclear power plant secu- 
rity efforts based on unclassified sources. 14 

In another case, currently in litigation, a federal air marshal blew the whistle 
when TSA attempted to reduce security on "high risk" flights, and the agency alleg- 
edly retaliated by retroactively designating the material he had disclosed as Sen 
sitive Security Information (SSI). 16 

Another concern arises out of the interplay between unclassified control markings 
and the Freedom of Inf ormation Act (FOIA). Certain unclassified control markings, 
including Sensitive Security Information (SSI) and Critical Infrastructure Informa- 



11 U.S. Gov't Accountability Office, Rep, No. GAO 06 385, Information Sharing: The 
Federal Government Nee»s to Establish Policies an» Processes for Sharing Terrorism- 
Rented and Sensitive Birr Unclassified Information (2006). 

12 Safeguarding Sensitive But Unclassified (For Official Use Only) Information, Mgt. Dir. No. 
11042 (2004), at http://www.fas.org/sgp/othergov/dhs sbu.html, revised by Mgt. Dir. No. 
11042,1, (2005), at http://www.fms.org/sgp/othergov/dhs sbu rev.pdf [hereinafter Safe- 
guarding]. 

"JASON Program Office MITRE Corporation, Horizontal Integration: Broader Ac- 
cess Modei^s for Realizing Information Dominance 5 (2004). 

»H.R. Rep. No. 109 8, at 16 (2005) (letter from Henry Waxman to Christopher Shays). 

15 Project on Gov't Oversight, Ai.t:rt: Robert MacLf.an v. DHS (2007), at http:// 
pogo. org / p /govern ment I rmacl eandhs.html 
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tion (CII), are specifically exempt by statute from release under FOIA. But some 
agencies have claimed that other unclassified control markings constitute an inde- 
pendent legal basis for exempting information from public disclosure under FOIA 
even in the absence of an express statutory exemption and even where the infoima- 
tion does not fit within an existing exemption. 

Such claims prompted the American Bar Association's House of Delegates to adopt 
a resolution in February 2006 urging the Attorney General to clarify that such des- 
ignations should not be used to withhold from the public information that is not au- 
thorized to be withheld by statute or executive order. 

As it happens, the DHS directive meets the ABA standard. It provides that FOUO 
information is not automatically exempt from disclosure under FOIA and that 
FOUO information may be shared with other agencies and government entities 
"provided a specific need to know has been established and the information is 
shared in furtherance of a coordinated and oflicial governmental activity." 16 

But whether or not an agency has a legal basis for withholding pseudo classified 
information not otherwise exempt under FOIA is almost beside the point. The des- 
ignation is itself sufficient to exert a chilling effect on FOIA disclosures. As Thomas 
S. Blanton of the National Security Archive testified before a subcommittee of the 
House Committee on Government Reform in March 2005, "the new secrecy stamps 
tell government bureaucrats 'don't risk it'; in every case, the new labels signal 'find 
a reason to withhold.'" 17 

An article published in the Washington Post on June 24, 2007, brought to light 
a pseudo-classification scheme apparently invented by the Vice President of the 
United States. His office has been giving reporters documents labeled: "Treated As: 
Top Secret/SCI" an apparent attempt to treat unclassified material as though it 
were Sensitive Compartmented Information (SCI)- a special access designation re- 
served for secrets whose disclosure would cause 'exceptionally grave damage to na 
tional security."' 18 

Unlike the Cheney innovation, Special Access Programs (SAPs), which limit ac- 
cess above and beyond the three tiered classification system, are authorized by law, 
and are confined to a relatively limited circle of senior officials. Exec. Order No. 
12859, as amended, provides that unless otherwise authorized by the President, 
only certain named officials are authorized to establish such programs. The list in- 
cludes the Secretaries of State, Defense, and Energy, and the DCI, or the principal 
deputy of each. Interestingly, the list does not include the Vice President perhaps 
in anticipation of his novel assertion that the Office of the Vice President is not an 
agency of the Executive Branch and need not comply with the requirement under 
Exec. Order 12859 that such agencies file an annual report with ISOO. 19 

The fact that SAPs are authorized by executive order does not mean they are im- 
mune from the deficiencies of pseudo-classifications. The Moynihan Commission 
noted a "lack of standardized security procedures" that "contributes to high costs 
and other difficulties," and recommended the establishment of a single set of secu- 
rity standards for Special Access Programs another of its sensible recommenda- 
tions which, as far as is known, has not been carried out. 2 o 

Recommendations for Congress 

Madame Chair, you and the subcommittee should be commended for exercising 
your oversight authority over the treatment of national security information both 
classified and unclassified at the Department of Homeland Security. Such scrutiny 
is essential, and it is long overdue. 

I would also respectfully suggest that the time has come for the committee, and 
for Congress, to exercise its legislative authority over these matters. For 67 years, 
Congress has largely ceded that authority to the president, and as I hope I have 
explained, the results have been decidedly mixed. 

It has been ten years since the Moynihan Commission urged Congress to legislate 
the rules that protect national security information, rather than leaving it up to the 
executive branch to police itself. It is time for Congress to take up that challenge. 

A. Systemic solutions 



Safeguarding, supra note 11. 



Subcomm. on Nat'l Sec, Emerging Ihreats and Ini 7 Relations of the House Comm. on Gov't Re 
form, 109th Cong. (2005) (statement of Thomas S. Blanton). 

^Barton Gellman & Jo Becker, A Different Understanding with the President, WASH. Post, 
June 24, 2007, at Al. 

19 Peter Baker, Cheney Defiant on Classified Material: Executive Order Ignored Since 2003, 
Wash. Post, June 22, 2007, at Al. 
20 Moynihan Commission Report at 28. 
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Many of the problems facing the classification system are systemic, and they re- 
quire comprehensive, government-wide solutions. Among other things, Congress 
should reinstate the provisions of Exec. Order No. 12958 which (a) established a 
presumption against classification in cases of significant doubt (a policy which the 
Moynihan Commission urged Congress to codify); (b) permitted senior agency offi- 
cials to exercise discretion to declassify information in exceptional cases where the 
need to protect, the information is outweighed by the public interest in disclosure; 
and (c) prohibited reclassification of material that had been declassified and re- 
leased to the public under proper authority. 

Congress also should undertake a thorough and comprehensive examination of the 

? rowing use of agency control markings to restrict access to unclassified informa- 
ion. Much has been said, and rightly so, about the importance of information shar- 
ing among government agencies. But what is the justi fication for a system that en 
trusts low-level employees and private contractors with the non-reviewable discre 
tion to determine whether an unclassified document a document that doesn't even 
rate a "Confidential" stamp a document that may not even qualify for a FOIA ex 
emption is too sensitive for public view? 

Before Congress acquiesces in the further proliferation of these designations, it 
should consider whether those that already exist place an unwarranted burden on 
the free exchange of information, not only among government officials, but between 
the government and the people who elect it. 

At a minimum, Congress should prohibit agencies from adopting unclassified con- 
trols that are not expressly authorized by statute (or executive order), and should 
mandate strict standards for any controls it does authorize to minimize their impact 
on public access. 

H.R. 5112, the Executive Branch Reform Act, which was reported by the House 
Government Reform Committee during the 109th Congress, directs the Archivist of 
the United States to promulgate regulations banning the use of information control 
designations not defined by statute or executive order. If the Archivist determines 
that there is a need for some agencies to use such designations "to safeguard infor- 
mation prior to review for disclosure," the regulations shall establish standards de 
signed to minimize restrictions on public access to information. The regulations 
shall be the sole authority for the use of such designations, other than authority 
granted by statute or executive order. 

This approach would ameliorate some of the worst features of what is today an 
unregulated wilderness of inconsistent standards and insufficient checks. But it 
begs the question of whether Congress should be authorizing agency officials to 
withhold unclassified information in the first place. Such powers are all too easily 
given, and once they are in place, it is virtually impossible to get rid of them. 

I hope that Congress will consider codifying standards that incorporate these poli- 
cies. But there are also many steps that can be taken to reform the management 
of national security information one department at a time. By undertaking such re 
forms at the Department of Homeland Security by making DHS the "gold stand 
ard" Congress can create a model for best practices that other agencies can adopt. 

B. The Classification System at DHS 

(1) Congress should establish an Information Security Oversight Office, modeled 
after the Information Security Oversight Office at the National Archives and 
Records Administration, to oversee security classification programs at DHS. Its 
responsibilities would include development of implementing directives and in- 
structions; maintenance of liaison with ISOO and agency counterparts; moni 
toring of agency compliance and preparation of reports to Congress; and devel 
opment of security classification education and training programs. 

(2) Congress should establish an independent DHS Classification Review Board 
to ensure that information is declassified as soon as it no longer meets the cri- 
teria for classification. Among the responsibilities of the board would be to fa- 
cilitate and review requests for declassification and classification challenges, 
and to conduct an independent ongoing review of classified materials to deter- 
mine whether they are properly classified. 

(3) Congress should establish an independent ombuds office within DHS to pro 
vide assistance with classification challenges and requests for declassification. 

(4) Congress should require the DHS Inspector General to conduct periodic au- 
dits of the DHS classification program and report to Congress on the appro 
priateness of classification decisions. 

(5) Congress should require DHS to implement a system of certification for DHS 
officials with classification authority and to provide them with training in prop 
er classification practices. 

C, Sensitive Information Controls at DHS 
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As noted above, I hope that Congress will reconsider the question of whether 
agency employees and private contractors should be given a license to withhold un- 
classified, non FOIA exempt information from the public. But short of curtailing the 
use of unclassified control markings, there are steps that can be taken by DHS to 
minimize error and abuse, and reduce the impact of pseudo-classification on public 
access to information. 

(1) Congress should require DHS to place strict limits on the number of agency 
officials authorized to designate FOUO and other unclassified information as 
controlled, to implement a system of certification for DHS officials with designa- 
tion authority, and to provide authorized officials with training in proper des- 
ignation practices. 

(2) Congress should require DHS to limit the duration of controls on unclassi 
fied information and provide procedures by which such controls can be removed. 

(3) Congress should require DHS to develop procedures by which members of 
the public can challenge unclassified designations. 

(4) Congress should require the DHS Inspector General to conduct periodic au 
dits of the use of controls on unclassified information and report to Congress 
on the appropriateness of designations. 

(5) The Homeland Security Committee should oversee DHS implementation of — 

a. The directives regarding the use of the SSI designation by TSA which 
Congress included in the DHS Appropriations Bill for FY 2007 (Pub. L. 
109-295). Those directives require review of any document designated SSI 
whose release is requested and require release of certain documents des- 
ignated SSI after three years unless the DHS Secretary provides an expla 
nation as to why it should not be released. 

b. The recommendations included in the GAO report of June 2005 evalu- 
ating the use of the SSI designation by TSA. 21 The GAO found significant 
deficiencies in 'PSA's management of SSI, and recommended that the Sec 
retary of DHS direct the TSA Administrator to: 

i. Establish clear guidance and procedures for using the TSA regula 
tions to determine what constitutes SSI. 

ii. Establish clear responsibility for the identification and designation 
of information that warrants SSI protection. 

iii. Establish internal controls that clearly define responsibility for 
monitoring compliance with regulations, policies, and procedures gov- 
erning the SSI designation process and communicate that responsibility 
throughout TSA. 

iv. Establish policies and procedures within TSA for providing special- 
ized training to those making SSI designations on how information is 
to be identified and evaluated for protected status. 

Conclusion 

By helping to ensure that the government keeps secret only the information that 
needs to be secret, these measures would enhance both openness and security at 
DHS and throughout the government. 
Thank you. 

Mr. CARNEY. Well, I thank the witnesses for their testimony; and 
I remind each member he or she will have 5 minutes to question 
the panel. 

I now recognize myself for 5 minutes, and this is for all the wit- 
nesses. If you could do one thing to overcome the overclassification 
or pseudo-classification problem at DHS, what reform initiative or 
best practice would you adopt? I know Mr. Agrast, you just men- 
tioned a few, but Mr. Leonard and Mr. Armstrong, Ms. Spaulding? 

Mr. Leonard. One that I would recommend, some agencies, such 
as State and CIA, as a best practice have independent advisory 
commissions comprised of historians that advise those agencies on 
the effectiveness of their agencies' declassification program. There 
is no reason why such an advisory committee could not be estab- 
lished on the front end of the process. An advisory committee may 



21 U.S. gov't Accountability Office, Rep. No. GAO-os-677 Transportation Securitv Am- 

MINISTRATION: CLEAR POLICIES AN» OVERSIGHT NEEDED FOR DESIGNATION OF SENSITIVE SECU 
R1TV INFORMATION (2005}. 
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be of the principal consumers, State and local officials with appro- 
priate clearances who could provide advice back to the Department 
as to the effectiveness of what they are classifying and its impact 
on their information needs. 

Mr. ARMSTRONG. Mr. Carney, I would emphasize — I think Ms. 
Spaulding made reference to the same phenomenon — in the tear — 
line system, or something like the tear-line system, emphasize the 
communication of important information in the least — controlled 
manner necessary. Remember that the purpose of all communica- 
tion in Government, whether it is the most sensitive intelligence or 
not, is to influence someone somewhere to take cognizance of it and 
to change their behavior or focus their analytical skills. In doing 
so, put the emphasis on communication and then minimize and re- 
strict the sources and methods portion of the communication to 
protect it. But put the emphasis on communicating, not with- 
holding. 

Ms. SPAULDING. I think the most important thing is to do some- 
thing to begin to change the culture and the mindset, and I think 
that is set at the top. That is a tone and an emphasis that is set 
at the top. 

So I would consider issuing, maybe even from the President, an 
Executive Order, for example, that would direct the agencies, De- 
partment of Homeland Security to begin with, to include in their 
performance evaluations the issue of overclassifi cation and under- 
classifi cation, how employees do in terms of getting the classifica- 
tion right, that that would be a factor in how they are evaluated. 
I think that would go a long way in setting the right tone. 

Mr. Carney. Are the evaluators in your opinion able to do that? 
Don't they have a vested interest in kind of keeping the system as 
it is? 

Ms. SPAULDING. Well, I think it would be combined with the 
kinds of recommendations that have been made at this table, in- 
cluding regular audits of documents that have been classified; and 
that would help to inform those kinds of performance appraisals as 
to whether this employee regularly is found to have overclassified 
documents, for example, or whether this employee has written a 
great number of unclassified reports that have been able to be 
widely disseminated. 

Those performance appraisals are fairly standardized actions; 
and if those forms have a specific thing that you have to fill in that 
relates to how this employee does in terms of their classification 
decisions, I think that would provide an appropriate incentive. 

Mr. Leonard. If I could add to that, as a follow-on, another best 
practice that is very closely related to that, the CIA, even though 
it is not required at the national level, requires a personal identi- 
fier on every product they produced as to who was responsible for 
the classification decision; and something like that facilitates a fol- 
low-up and holding people accountable. 

Mr. Agrast. If I could also add, I completely agree with the rec- 
ommendations, particularly with the remarks of Ms. Spaulding. 

Mr. Reichert opened his portion of the hearing by talking about 
his experience as a law enforcement officer at the State and local 
level. I think there are two kind of prosecutors. There are two 
kinds of law enforcement officers. There is the kind that says my 
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job is to convict as many people as' possible, and there is the other 
kind who says my job is to get the truth, and I will be satisfied 
that I have done my job if I convict the people who are guilty and 
don't convict the people who are not guilty. 

I think that is the cultural change that has to happen at these 
agencies so the premium is set not solely on the number of docu- 
ments you have successfully kept from the public but using dis- 
cernment and using fine judgment in determining when and 
whether classification decisions should be made. 

Mr. Carney. Thank you. 

Mr. Leonard, I know your office is responsible for regulating clas- 
sification by agencies within the executive branch; and you consist- 
ently stated that the Government classifies too much information. 
Why is this happening, in your opinion? What is the reason? 

Mr. LEONARD. Reasons are varied, but I would agree more than 
anything else with Ms. Spaulding's assessment that it is really one 
of culture. We are very effective in terms of holding people account- 
able for the inappropriate disclosure of information, either adminis- 
tratively or criminally. Very rarely, if ever, have I ever seen anyone 
held accountable for inappropriately withholding or hoarding infor- 
mation. 

Mr. Carney. Too many people have classification power? 
Mr. Leonard. Yes. 

Another best practice — and Mr, Agrast mentioned this — is DOE 
follows it. They actually require people to be trained and certified 
before they can affix classification controls on the product, as op- 
posed to just having clearance and having access to it. 

So something along those lines would facilitate accountability, 
because you could have something to take away from them now if 
they abuse it, and it restricts the universe of people that you have 
to make sure are appropriately trained. So there is a lot of benefits 
to it all around. 

Mr. CARNEY. Thank you. 

I now recognize'the ranking member, my good friend from Wash- 
ington, Mr. Reichert. 

Mr. Reichert. Thank you, Mr. Chairman. 

I just wanted to go back to Mr. Carney's original question, which 
was if you do one thing. I want to ask it in just a little bit of a 
different way. 

What is the biggest hurdle — I have an answer in my mind, in my 
experience, but what is the biggest hurdle to overcome in this 
whole issue of not sharing information and overclassifying? 

Okay, I will give you a hint at least where I am going with this. 
Somebody mentioned the stovepipe thing. And, to me, really to get 
more specific, governance, who has control over the information? 
Who is the lead person? At the local level in the sheriffs office, 
with 38 police departments and the sheriffs in the county, you 
know, the battle is over who controls the server that has the infor- 
mation. And you are running into that sort of an issue at the Fed- 
eral level. I am sure you are. 

Mr. ARMSTRONG. I think what we have seen, Mr. Reichert, is 
that the leadership of the various departments — that we had the 
merger into the Department of Homeland Security and specific in- 
centives given — direction given to the DNI to begin to break down 
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the barriers, break down the stovepipes. But it requires the leader- 
ship to do that. 

The drift in the bureaucracy is toward safety, is toward the 
norm, is toward withholding, is toward not exposing oneself to criti- 
cism. Until and unless someone initiates a test-bed of a new direc- 
tion and puts the incentive on making sure that everyone knows 
what they need to know, but all of what they need to know, this 
will not happen. Things will not change. It will default back to the 
old system. I think that is the problem we are faced with. 

Mr. Reichert. Certainly the difficulty is highlighted as you bring 
the 22 departments under the one Homeland Security umbrella. 
But it even gets more complicated then as you reach outside to the 
other agencies that don't report to the homeland security effort. So 
I mean it is a huge issue to overcome. Does anyone have any sug- 
gestions? 

Mr. LEONARD. I would suggest, Mr. Reichert, another major hur- 
dle is the myriad of information protection regimes that exist with- 
in the Federal Government. There is no individual who can com- 
prehend and understand all of them, even know of all of them. 
While there are efforts under way within the executive branch to 
streamline that and what have you, there are still contributing 
issues, many of them statutorily based, in terms of establishing re- 
quirements for protecting critical infrastructure information and 
things along those lines. What that results in is it is incomprehen- 
sible to me how an operator, who has decisions to make on a day- 
to-day basis and getting information from multiple sources, how 
they can even begin to understand what they can and what they 
can't disclose. And it can result in paralysis. 

Mr. Reichert. It almost seems as though the local agencies take 
the lead in this arena. As we in Seattle took a look at the LInX 
System spearheaded by the U.S. attorney's office, the FBI choosing 
not to participate in that information-sharing experiment and the 
U.S. Naval Intelligence then taking the lead with the U.S. attor- 
ney's office, finally after a few years we have a system in Seattle 
now that we have partners. 

I think one team at a time, one maybe part of the country at a 
time coming together, being able to showcase a success, would you 
not agree that might be a way to address this issue? Mr. Agrast? 

Mr. AGRAST. Yes, I very strongly agree. I think pilot programs 
and State experimentation is really a very useful tool here. When 
people, as you have heard, are reluctant to change, I think they 
need to see success stories. They need to see that it can work and 
that there is a better way to do these things. 

Mr. Reichert. Ms. Spaulding, you mentioned along the same 
lines this cultural change, and several of you have. I really see that 
as really the biggest issue, and it is a leadership concern, you 
know, from protecting to sharing. Do you have any ideas on how 
to really jump-start that? 

Ms. SPAULDING. Well, the Markle Foundation talks about cre- 
ating a culture of distribution. But I think you are right. That is 
the most important thing. And, as I said, I think there are some 
suggestions in terms of creating — there is already, as Mr. Leonard 
pointed out, a huge incentive for classifying documents. It is career 
ending if you fail to classify something that is then disclosed and 
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causes harm to national security. So there is a huge incentive to 
classify. It is much easier to classify a document. It is just a safe 
bet. And we have to create incentives for being more careful about 
that decision and incentives for creating unclassified documents. 
You know, as I said, I have got a number of suggestions for that 
in my testimony. 

But I do think there are legitimate concerns that present a stum- 
bling block. You asked about what are some of the major stumbling 
blocks. Having the trust that an agency isn't going to take your in- 
formation and somehow disrupt your operational activity, and I am 
sure you understand exactly what I am talking about. 

Mr. Reichert. Yes, I do. 

Ms. Spaulding. And it is a legitimate concern, but it is also one 
of the major reasons why we find problems sharing information, 
particularly among law enforcement and, you know, agencies that 
have the ability to take action or are undertaking operations. And 
I saw this in spades when I was at the intelligence, when I was 
at CIA, and their relationships with the other agencies, FBI, Cus- 
toms, whatever, the concerns on both sides of that that one or the 
other would take the information and run an operation that would 
mess up what the other agency had going. 

So the challenge there, the solution there it seems to me has got 
to be operational coordination. It can't be that you are allowed to 
withhold that information, and there I think is a place where par- 
ticularly State and locals can provide excellent models. 

Mr. Reichert. Those agencies that have ongoing investigations, 
especially with CIs, are very concerned about sharing information. 



Mr. CARNEY. Thank you, Mr. Reichert. 
I will now recognize Mr. Dent from Pennsylvania for 5 minutes, 
and we will probably do another round. Okay. 
Mr. Dent. Thank you, Mr. Chairman. 

Ms. Spaulding, you just brought up an issue that I find inter- 
esting, and I wonder if we could talk about this issue. There are 
incentives to overclassify right now, but the only real control over 
information resides in the classification realm. Isn't overclassiflca- 
tion a natural reaction to unauthorized disclosure of sensitive but 
unclassified materials? There is no punishment for — serious pun- 
ishment for releasing sensitive material. 

Ms. Spaulding. As I said in my testimony, I think that over- 
classification actually contributes to a lack of respect for the classi- 
fication mark and therefore actually makes it harder to protect 
true national security secrets. 

I think overclassiflcation is a detriment to protecting truly secret 
information. So I do think that that is also part of the incentive 
structure in terms of when you are looking at leaks is that over- 
classification does contribute to that kind of culture as well. 

I think in addition to clearly trying to find ways to identify peo- 
ple who disclose classified information and take action, firm action 
against people who disclose classified information, I think it is im- 
portant also at all levels of Government to reinforce the respect for 
classification markings. 

Mr. Dent. Well, I guess as a follow-up, how can the Federal Gov- 
ernment really balance the need? You know, how do we balance 
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this need I guess to share information on the one hand, and at this 
unclassified level, with the knowledge that somebody somewhere 
continues to leak sensitive but unclassified information? I think 
that is really the crux of the problem here. 

Ms. Spaulding. My sense is that trying to hold more tightly to 
that information within those stovepipes has not been an effective 
way of preventing those disclosures. And therefore, I think, as I 
said, in addition to trying to use technology to help us with audit 
trails to keep track of who is accessing information, who is printing 
information, who has access to the information that might be dis- 
closed and trying to identify those people and hold them account- 
able, that it really is important that we indicate that we have 
taken more care in labeling things. So that when they are labeled, 
whether it is classified or sensitive, law enforcement sensitive, that 
in fact there has been a reasoned determination that could be 
upheld as we look at it after the fact that this would harm national 
security or homeland security or law enforcement interests. 

Mr. Armstrong. Mr. Dent? 
. Mr. Dent. Yes. 

Mr. ARMSTRONG. After three decades as a journalist in this town, 
I have to recognize that there is an information economy, there is 
an information currency within secrecy, that every major agency at 
every senior level leaks classified information, controls and manip- 
ulates classified information, and in parallel at other levels, either 
in other agencies or in the same agencies, other people speak can- 
didly, but they speak in terms of things that aren't genuinely se- 
cret. 

When everything is secret, as Potter Stewart said, nothing is se- 
cret. No one knows what to respect. Most senior officials have some 
criteria, make judgments every day, several times a day, about how 
to share information that is technically classified but to get it out 
in some form that it believes the public needs to know or their col- 
leagues need to know, without filing all the forms. It has caused 
problems from time to time, but there is an ongoing communication 
about what those standards are. And it is possible, particularly in 
the form that we are talking about today, to emphasize how to 
communicate without damaging the national security. Better to do 
it within the system than have it done without the system. 

Mr. Dent. I guess you are addressing it, but the question I have, 
how do we balance this need to share this information at the un- 
classified level with the knowledge that somebody somewhere con- 
tinues to leak sensitive but unclassified information? I guess that 
is the question. How do you balance this? 

Mr. AGRAST. Mr. Dent, one thing I guess I would hope we would 
do is have these unclassified markings regulated by Congress. They 
have taken on a life of their own. They are so numerous and so 
varied, there are so few standards and safeguards. You know, the 
classification system, with all its problems, looks pretty good com- 
pared to the pseudo-classification nonsystem. 

So rather than have agencies making ad hoc decisions and bring- 
ing the entire system of controlled information into disrepute, 
shouldn't Congress take a look at this comprehensively and decide 
whether such categories should exist at all? Or whether, instead, 
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if information is truly in need of safeguarding, it ought not to be 
classified in the first place? 

Mr. Dent. Yield back. 

Mr. Carney. Thank you, Mr. Dent. 

We will start a second round of questions here. 

Mr. Armstrong, in your estimation, how effective has DHS been 
in producing reports and products at the unclassified level? 

Mr. Armstrong. Well, we read unclassified material when it is 
presented by DHS. But, more often, we read the relevant informa- 
tion when it is put in unclassified form when it is leaked to DHS 
because of the form of controls that have been established that ef- 
fectively discourage and inhibit candid communication. The number 
of inappropriate things that have happened to try and block con- 
tractors or the employees of contractors in using information in 
labor disputes, for example, does not increase respect for the sys- 
tem; and the difficulty we have had is the difficulty of account- 
ability. 

Mr. Leonard administers some degree of accountability within a 
classified system, but it is very difficult to do when, effectively, a 
department has authority to create all sorts of constraints on com- 
munication that are not necessarily constraints designed to protect 
national security; and the farther we move away from those for the 
original purpose to protect sources and methods, to protect short- 
term objectives that need to be accomplished, to coordinate at dif- 
ferent levels of our government, and we move into areas where po- 
litical control and sensitivity — it seems to us on the outside that 
the Secretary of Homeland Security has been virtually unaccount- 
able to Congress, unaccountable to other agencies and ineffective in 
the administration of his mandates. 

Mr. Carney. What is the solution to that? 

Mr. Armstrong. Well, I don't know what you need to do to get 
him here to talk with you, but I think there are issues that can 
be addressed about in a public executive session. He has unbeliev- 
ably large sets of responsibilities, but at various levels throughout 
the Department there are professionals who would like to do their 
job properly. I don't believe that they are getting the leadership. 
The leadership sometimes emerges when it is variegated by ques- 
tions. 

The truth — the most important purpose, Woodrow Wilson said, 
for Congress is not to pass legislation but to inquire into how gov- 
ernment is effectively being done; and it is that process that needs 
to occur and occur more publicly. 

Mr. Carney. Thank you. 

Mr. Agrast, in your estimation, how much information is being 
withheld by DHS and its private contractors that is unclassified 
and non-FOIA exempt? 

Mr. Agrast. I actually have no idea how much is being withheld. 
We have indications that, to the extent there are standards, they 
aren't being followed. I will give you one example, if I may, from 
my prepared testimony. 

The GAO, the Government Accountability Office, issued a report 
in June of 2005 evaluating the use of the SSI designation by the 
TSA, which is of course a unit of the Department; and they found 
significant deficiencies in TSA's management of SSI information 
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and recommended that the Secretary direct the Administrator to 
take a number of remedial actions. 

One is to establish clear guidance and procedures for using the 
regulations to determine what constitutes SSI. The second is to es- 
tablish clear responsibility for the identification and designation of 
information that warrants SSI protection. The third was to estab- 
lish internal controls that clearly define responsibility for moni- 
toring compliance with regulations, policies and procedures gov- 
erning the designation process and to communicate that responsi- 
bility throughout TSA. And, finally, to establish policies and proce- 
dures within TSA for providing specialized training to those mak- 
ing SSI designations on how information is to be identified and 
evaluated for protected status. 

Clearly, those recommendations have yet to be implemented in 
a proper way; and it is surely within the purview of this sub- 
committee to inquire as to the progress that is or is not being 
made. 

Mr. Carney. How should DHS implement the new control of un- 
classified information originating from CUI that Ambassador 
McNamara developed? Mr. Agrast, sorry to interrupt your drink 
there. 

Mr. Agrast. You know, I would have to give more consideration 
to how they ought to go about it on an agency basis. Certainly 
there are some of these areas that are interdepartmental in nature, 
and some of these kinds of policies and practices require coordina- 
tion. I am not sure that a single agency can do it. 

Mr. Carney. So you don't think it is something that DHS could 
do quickly or necessarily? 

Mr. Agrast. Not sure. 

Mr. Carney. Ms. Spaulding, do you have any idea? 

Ms. SPAULDING. Certainly one thing to consider, and particularly 
when you are talking about these pseudo-classifications, is requir- 
ing that they be done at a fairly senior level. Mr. Leonard touched 
on this both with respect to classification and pseudo-classification, 
having people well-trained and certified with the authority to, you 
know, put that stamp on the document. But particularly in this 
area I think it would be helpful to move those decisions to a more 
senior level. 

Mr. Carney. Thank you. 

Mr. Reichert, any more questions? 

Mr. Reichert. Thank you. I will just make mine pretty quick 
here. 

Last year, we passed a bill that directed some cooperation in 
fighting terrorism, cooperating at the international level, mostly 
through technology, those countries like Israel and Canada and the 
U.K. and others who have been — Australia — who have been kind of 
dealing with this a little longer than we have, a lot longer in some 
cases. They have developed some technologies and some systems. 
Would you consider that we should consult these countries who 
have had this experience in classifying and unclassifying and over- 
classification and pseudo — classification? Should we be looking for 
leadership from those other countries? And do you have any infor- 
mation or knowledge about that occurring now? Anybody. 
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Mr. LEONARD. I don't have any knowledge, direct knowledge in 
terms of whether it is occurring or not, Mr. Reichert. But some- 
thing along those lines, that definitely has merit, if only from the 
perspective of ensuring that we have congruous systems. Because 
I know that we do that on the classification level where we rou- 
tinely, especially with our close allies and friendly nations, work to 
ensure that we have congruous systems that facilitate the sharing 
of classified information, especially when we are in a coalition envi- 
ronment and things along those lines. So those types of efforts 
clearly could bear fruit on the unclassified level. 

Now to the extent of whether they are occurring or not, I really 
don't know. 

Mr. Reichert. Anyone else have — 

Mr. ARMSTRONG. Most of the technologies that I think to which 
you are referring that would be helpful here are employed in the 
business realm already and for different reasons and with different 
levels, obviously, of security and devotion to principles. But we are 
talking about techniques. The notion of embedding metadata be- 
gins to track intellectual product and the ability to not only deter- 
mine where it has gone or how it has been used or whether it has 
been appropriately dealt with but also to automatically begin to 
alert people to the fact that it is no longer controlled or it requires 
additional controls for an additional reason. 

All of those things are present at high levels in certain business 
environments, but they are expensive, and the incentives have to 
be high. Capitalism tends to find some degree of incentives. One 
would think that homeland security and anti-terrorism measures 
could find at least as high a level. 

Mr. Reichert. Mr. Agrast, did you have — 

Mr. AGRAST. Congressman, I think it is an extraordinarily 
thoughtful question. There has been a tendency not to look abroad 
for answers, and I think that has demonstrated itself to be a mis- 
take. We don't have to do what other countries do, but we should 
at least learn what we can from them. 

Mr. Reichert. Yes. Thank you. 

One last thought. With this new world of technology and our sol- 
diers fighting around the world and their access to various commu- 
nication devices, cell phones and cameras in their cell phones and 
computers, they are communicating back to their families and 
friends real-time info on battles occurring or briefings that are oc- 
curring. How do you see that issue being addressed in the sharing 
of information that could be critical to our operations in fighting 
terrorism? 

Mr. LEONARD. Well, what I see that is emblematic of a challenge 
we always have, and that is we are playing catch-up to technology 
all the time, especially from the point of, A, leveraging it but, B, 
understanding the ramifications from a security or vulnerability 
point of view as well. And then when we attempt to address it, we 
usually do it in a hand-fisted way, which is sometimes analogous 
to trying to repeal gravity. 

So the challenge is to somehow, some way get in front of that 
curve all the time and fully understand the capabilities and the 
limitations of the technology and try to keep our policies abreast 
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o f it, rather than being i n that proverbial catch-up mode which we 
seem to be in. 

Ms. SPAULDING. I don't think there is a technological solution, 
whether it is some new technology or shutting down some of those 
technology outlets, because you will never get them all. I think the 
only solution to that particular issue is training. I mean, you have 
simply got to sensitize, you know, those folks to what they can and 
should not be sharing and disclosing publicly. And you will never 
have perfect success with that, but it seems to me that trying to 
attack that, the basis of technology, is not going to be very success- 
ful. 

Mr. Reichert. Yeah. You know — one of the experiences I will 
share real quick — in the Green River investigation in 1987, the 
search warrant to be served on the suspect who we finally arrested 
years, years later — we had a meeting on the service of the search 
warrant. I was the detective in charge of the search of this subject's 
house; and, as I arrived, standing on the front porch was a reporter 
from our local newspaper to greet me. So someone within the meet- 
ing immediately shared the information. 

That is really one of the frustrations I think in this whole thing. 
You talked about building trust and in those local agencies and 
within those agencies within the Federal Government, too, in hav- 
ing the knowledge that their information is protected as the inves- 
tigation is ongoing. The firewalls that can be built in a system to 
protect that information is a huge hurdle I think to overcome and 
also plays into the cultural change. 

So I appreciate you being here this morning, and thank you so 
much for your testimony. 

Mr. Carney. Well, I want to thank the witnesses as well for their 
invaluable testimony. This truly is an issue that we have to further 
explore to shed light on the classification issue. It is absolutely es- 
sential. 

The members of the subcommittee will probably have additional 
questions for the witnesses, and we ask that you respond expedi- 
tiously in writing. 

Hearing no further business, the subcommittee stands adjourned. 

[Whereupon, at 11:15 a.m., the subcommittee was adjourned.] 

For the Record 

Prepared Opening Statement of the Honorablk Jane Harman, Chairman, 
Subcommittee on Intelligence, Information sharing, and Terrorism Risk 
Assessment 

March 22, 2007 

• Good morning. I'd like to welcome you all to this hearing on the increasing 
problems of over classification and pseudo classification and their impact on what 
is the lifeblood of our homeland security: effective information sharing with our 
State, local, and tribal law enf orcement officers. 

• The United States has had a classification regime in place for decades: informa- 
tion and intelligence typically falls into one of three categories: Top Secret, Secret, 
or Confidential. 

• Our nation adopted this regime for one reason: to protect sensitive sources and 
methods. 

• Contrary to the practice of some in the federal Intelligence Community, classi- 
fied markings are NOT to be used to protect political turf or to hide embarrassing 
facts from public view. 
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• Indeed, a recurrent theme throughout the 9/11 Commission's report was the 
need to prevent widespread over classification by the Federal government. The Com- 
mission found that over classification interferes with sharing critical information 
and impedes efficient responses to threats. 

• The numbers tell us that we are still not heeding the Commission's warning. 

• Eight million new classification actions in 2001 jumped to 14 million new ac- 
tions in 2005, while the quantity of declassified pages dropped from 100 million in 
2001 to 29 million in 2005. 

• In fact, some agencies were recently discovered to be withdrawing archived 
records from public access and reclassifying them! 

• Expense is also a problem: $4.5 billion spent on classification in 2001 increased 
to $7,1 billion in 2004, while declassification costs fell from $232 million in 2001 to 
$48.3 million in 2004. 

• In addition, an increasing number of policies to protect sensitive but unclassi- 
fied information from a range of Federal agencies and departments has begun to 
have a dramatic impact. 

• At the Federal level, over 28 distinct policies for the protection of this informa- 
tion exist. 

• Unlike classified records, moreover, there is no monitoring of or importing on 
the use or impact of protective sensitive unclassified information markings. 

• The proliferation of these pseudo-classifications is interfering with interagency 
information sharing, increasing the cost of information security and limiting public 
access. 

• Case in point: this document from the Department of Homeland Security 
(HOLD UP RADICALIZATION IN THE STATE OF CALIFORNIA SURVEY). 

• In a few weeks, I will be leading a field hearing to Torrance, California, to ex- 
amine the issues of domestic radicalization and "home grown" terrorism. 

• This DHS document a survey on radicalization in the State of California is 
marked "Unclassified/Tor Official Use Only." 

• On Page 1 in a footnote, the survey states that it cannot be released "to the 
public, the media, or other personnel who do not have a valid ?need to know' with- 
out prior approval of an authorized DHS official." 

• Staff" requested and was denied that approval. 

• Staff also asked for a redacted version of the document so we could use at least 
some of its contents at the coming California hearing. DHS was unable to provide 
one. 

• Let me be clear: I'm not denying that there may be sensitive information in- 
cluded in this survey, but it illustrates my point: what good is unclassified informa- 
tion about threats to the homeland if we can't discuss at least some of it at a hear- 
ing? 

• How can we expect DHS and others to engage the public on important issues 
like domestic radicalization if we hide the ball? 

• Unfortunately, this is nothing new. In 1997, the Moynihan Commission stated 
that the proliferation of these new designations are off en mistaken for a fourth clas- 
sification level, causing unclassified information with these markings to be treated 
like classified information. 

• These continuing trends are an obstacle to information sharing across the Fed- 
eral government and with State, local, and tribal partners including most espe 
cially with our partners in the law enforcement community. 

• Unless and until we have a robust intelligence and information sharing system 
in place in this country, with a clear and understandable system of classification, 
we will be unable to prevent a terrorist attack on the scale of 9/11 or greater. 

• That is why this Subcommittee will focus its efforts in the 110th Congress on 
improving information sharing with our first preventers the men and women of 
State, local, and tribal law enforcement who are the "eyes and ears" on our front 
lines. 

• And it's why we will pay particular attention to the issues of over-classification 
and pseudo-classification of intelligence and what we can do to ensure that we err 
on the side of sharing information. 

• We'll do this work in the right way partnering with our friends in the privacy 
and civil liberties community who want to protect America while preserving our 
cherished rights. 

• I would like to extend a warm welcome to our witnesses who will be talking 
about these issues. 

• On our first panel, we have assembled an array of experts who will be testifying 
about the extent of these problems and where things are trending. 
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• Our second panel of law enforcement leaders will talk about how over-classifica- 
tion and pseudo-classification are impacting their ability to keep our communities 
safe. 

• In addition, I hope the witnesses will provide the Subcommittee with a sense 
of how we might solve the challenges ahead of us, with the goal of ensuring the flow 
of information between the Federal government and State, local and tribal govern- 
ments. 

• Welcome to you all. 

Prepared Statement of the Honorable Bennie G. Thompson, Chairman, 

Committee on Homeland Security 

March 22, 2008 

• Thank you, Madame Chair, and I join you in welcoming our distinguished wit- 
nesses today to this important hearing on the problem of over and pseudo classi- 
fication of intelligence. 

• Information sharing between the Federal government and its State, local and 
tribal partners is critical to making America safer. 

• But we won't get there if all we have is more and more classification, and more 
and more security clearances for people who need access to that classified informa- 
tion. 

• The focus should be different. 

• The Federal government instead must do all it can to produce intelligence prod- 
ucts that are unclassified. 

• Unclassified intelligence information is what our nation's police officers, first re- 
sponders, and private sector partners need most. 

• They have told me time and time again that what they DON'T need is informa 
tion about intelligence sources and methods. 

• An officer on patrol in Jackson, Mississippi, or Des Moines, Iowa, has no use 
for the name of the person in Afghanistan, Africa, or elsewhere who provided the 
information or whether i t was obtained from an intercepted communication. 

• What he or she wants to know is if the information is accurate, reliable and 
timely, 

• If so, police chiefs and sheriffs can use it to drive their daily operations espe- 
cially when it comes to deciding where to put their people to help prevent attacks. 

• That's what intelligence is all about: if it can't tell an officer on the beat what 
to prepare for and how, what good is it? 

• Over-classification and pseudo classification are nothing new, but 9/11 has 
made these problems worse. 

• It's my understanding that security concerns after the September 11th attacks 
prompted some agencies and departments to shield whole new categories of informa 
tion with Confidential, Secret or Top Secret markings. 

• What might have started as a noble intention to protect the homeland has bro- 
ken down into a system of often excessive, abusive and/or politically motivated clas- 
sification decisions. 

• It's time to fix things. 

• This hearing will be the first of several on over and pseudo classification and 
will help us get a handle on the scope of the problem. 

• I hope each of the witnesses will be forthcoming in their assessments of these 
issues and how we can help. 

• Welcome to you all. I look forward to your testimony. 

o 
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